demoaffiliate.xyz Open in urlscan Pro
2606:4700:3037::ac43:dd8b  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. http://atgence.com/sondate/ Page URL
2. https://demoaffiliate.xyz/rasidate/amo/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ Show response atgence.com/sondate/	378 B 541 B	100ms 55ms	Document text/html	46.16.200.89 HOSTEUR-NET-CORE-
General Check archive.org Show headers Download Go to Full URL http://atgence.com/sondate/ Protocol HTTP/1.1 Server 46.16.200.89 , Switzerland, ASN207758 (HOSTEUR-NET-CORE-, CH), Reverse DNS Software Apache / Resource Hash 9530f9c073d339831cf2491e1354b3be23474cc21a01652c23591d7470b85e97 Request headers Host atgence.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers Date Tue, 01 Jun 2021 16:49:57 GMT Server Apache Last-Modified Mon, 31 May 2021 10:18:13 GMT ETag "1604f4-17a-5c39d8b020340" Accept-Ranges bytes Vary Accept-Encoding Content-Encoding gzip Content-Length 255 Connection close Content-Type text/html
GET H2	200	Primary Request / Show response demoaffiliate.xyz/rasidate/amo/	9 KB 3 KB	380ms 343ms	Document text/html	2606:4700:3037::ac43:dd8b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://demoaffiliate.xyz/rasidate/amo/ Requested by Host: atgence.com URL: http://atgence.com/sondate/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:dd8b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 64b4218d348251d7d1ad663d73fba55ba6c4f40889de5f7d6eb56121603e09c5 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :method GET :authority demoaffiliate.xyz :scheme https :path /rasidate/amo/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest document referer http://atgence.com/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Referer http://atgence.com/ Response headers date Tue, 01 Jun 2021 16:48:16 GMT content-type text/html; charset=UTF-8 vary Accept-Encoding x-frame-options SAMEORIGIN x-xss-protection 1; mode=block x-content-type-options nosniff cf-cache-status DYNAMIC cf-request-id 0a6a12e6ef00004a5667be9000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=LWBgRAvxtLUqef6MCOZehqY5S3awa2TIBAF77%2BosqxviBfolr3qOcBPWcXZiEsfiCVgLcLJaZwdU3yx8CGGt7wr%2FC4d0CTjSryXlc7HhlZYIFTz5Kye2bKwadVDhU9njj5Kya6TkS12kQvg%3D"}],"group":"cf-nel","max_age":604800} nel {"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 6589edb7ef7f4a56-FRA content-encoding br alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
GET H2	200	bootstrap.min.css stackpath.bootstrapcdn.com/bootstrap/4.4.1/css/	156 KB 21 KB	35ms 32ms	Stylesheet text/css	2606:4700::6812:acf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.4.1/css/bootstrap.min.css Requested by Host: demoaffiliate.xyz URL: https://demoaffiliate.xyz/rasidate/amo/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2ff5b959fa9f6b4b1d04d20a37d706e90039176ab1e2a202994d9580baeebfd6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Origin https://demoaffiliate.xyz Referer https://demoaffiliate.xyz/ User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers date Tue, 01 Jun 2021 16:48:16 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 601, 617, 617 age 123665 cdn-cachedat 2021-05-31 05:21:09 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 cf-request-id 0a6a12e84e0000dff34d849000000001 timing-allow-origin * access-control-allow-origin * last-modified Mon, 25 Jan 2021 22:04:09 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/css; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid e4076c2c515c77de0861626146f055d2 cf-ray 6589edba18eadff3-FRA cdn-requestcountrycode DE cdn-requestpullsuccess True
GET H3-29	200	p11.png demoaffiliate.xyz/rasidate/amo/cap/	100 KB 100 KB	34ms 20ms	Image image/png	2606:4700:3037::ac43:dd8b CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://demoaffiliate.xyz/rasidate/amo/cap/p11.png Requested by Host: demoaffiliate.xyz URL: https://demoaffiliate.xyz/rasidate/amo/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3037::ac43:dd8b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7c4ee816e44f918103b472b9f25f8d6cca02ee7deda0df72b24b358790a760c8 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /rasidate/amo/cap/p11.png pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority demoaffiliate.xyz referer https://demoaffiliate.xyz/rasidate/amo/ :scheme https sec-fetch-site same-origin :method GET Referer https://demoaffiliate.xyz/rasidate/amo/ User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers date Tue, 01 Jun 2021 16:48:16 GMT x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 128610 alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 content-length 102162 cf-request-id 0a6a12e85a00002484a71a5000000001 last-modified Mon, 31 May 2021 00:39:58 GMT server cloudflare x-frame-options SAMEORIGIN etag "60b4305e-18f12" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=D%2Bu5j9289Jjlbp4Or3N3%2BfIXmw9yoVuq7Auu4GT4yepHLMUxFBCQzkfH%2F5%2FxupS46SVMEHiWHw3J0rN9BIpl4HKPUqoiXJ00jqsOF3fVgivG3oFudNtaUKSNno1rSgisDem97f%2BZtMR3WqU%3D"}],"group":"cf-nel","max_age":604800} content-type image/png x-xss-protection 1; mode=block cache-control public, max-age=2592000 accept-ranges bytes cf-ray 6589edba2d7f2484-FRA expires Wed, 30 Jun 2021 05:04:46 GMT
GET H3-29	200	m11.png demoaffiliate.xyz/rasidate/amo/cap/	37 KB 37 KB	39ms 27ms	Image image/png	2606:4700:3037::ac43:dd8b CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://demoaffiliate.xyz/rasidate/amo/cap/m11.png Requested by Host: demoaffiliate.xyz URL: https://demoaffiliate.xyz/rasidate/amo/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3037::ac43:dd8b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 08ac96cbcdec9ec14e257b53d9bfae5ff8d6e233a9bed2d0beab49082b267f97 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /rasidate/amo/cap/m11.png pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority demoaffiliate.xyz referer https://demoaffiliate.xyz/rasidate/amo/ :scheme https sec-fetch-site same-origin :method GET Referer https://demoaffiliate.xyz/rasidate/amo/ User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers date Tue, 01 Jun 2021 16:48:16 GMT x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 128594 alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 content-length 37576 cf-request-id 0a6a12e85800002484de3a1000000001 last-modified Mon, 31 May 2021 00:39:58 GMT server cloudflare x-frame-options SAMEORIGIN etag "60b4305e-92c8" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=nkOUSz%2FfkSJlUp7rpEvvPDhmWtWQ7uBG%2B5tife4UnCWHV%2FClWHeYgFf3w6Ol9ij10N1dHRISVCcAyppANOoyVgV7%2Bcr2Jh%2Fi6zc1z6f3%2F3GNRJyFnhGj%2FCilAHBiUj8jivYVrwQM1psiviQ%3D"}],"group":"cf-nel","max_age":604800} content-type image/png x-xss-protection 1; mode=block cache-control public, max-age=2592000 accept-ranges bytes cf-ray 6589edba2d752484-FRA expires Wed, 30 Jun 2021 05:05:02 GMT
GET H3-29	200	p2_2.png demoaffiliate.xyz/rasidate/amo/cap/	45 KB 45 KB	27ms 14ms	Image image/png	2606:4700:3037::ac43:dd8b CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://demoaffiliate.xyz/rasidate/amo/cap/p2_2.png Requested by Host: demoaffiliate.xyz URL: https://demoaffiliate.xyz/rasidate/amo/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3037::ac43:dd8b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8138be10ba8f34b704e48bf0291317e7de8c0892fd00ee1ef1a1696b1ea5ccab Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /rasidate/amo/cap/p2_2.png pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority demoaffiliate.xyz referer https://demoaffiliate.xyz/rasidate/amo/ :scheme https sec-fetch-site same-origin :method GET Referer https://demoaffiliate.xyz/rasidate/amo/ User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers date Tue, 01 Jun 2021 16:48:16 GMT x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 127775 alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 content-length 45590 cf-request-id 0a6a12e85900002484c23f3000000001 last-modified Mon, 31 May 2021 00:39:58 GMT server cloudflare x-frame-options SAMEORIGIN etag "60b4305e-b216" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=46QTVX5ljlMKR7Xte9Qm6XscJXHY05SSVqkgslIhnSQbMOy3kmcHOpzb6xV9gEDjo4sdrdpdnrx%2FPNzLU96N5%2FYhz%2BTwPRjiLDTmnaIW2W%2BXQV0bv1U3hN5gE7sBhqxpBzrGnRAJ45Lx2zs%3D"}],"group":"cf-nel","max_age":604800} content-type image/png x-xss-protection 1; mode=block cache-control public, max-age=2592000 accept-ranges bytes cf-ray 6589edba2d7d2484-FRA expires Wed, 30 Jun 2021 05:18:41 GMT
GET H3-29	200	p3.png demoaffiliate.xyz/rasidate/amo/cap/	71 KB 71 KB	51ms 39ms	Image image/png	2606:4700:3037::ac43:dd8b CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://demoaffiliate.xyz/rasidate/amo/cap/p3.png Requested by Host: demoaffiliate.xyz URL: https://demoaffiliate.xyz/rasidate/amo/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3037::ac43:dd8b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8c8014b809bdfd98c022805c1b412488e84576b649c67094e1cd8f1a2d9ccc97 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /rasidate/amo/cap/p3.png pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority demoaffiliate.xyz referer https://demoaffiliate.xyz/rasidate/amo/ :scheme https sec-fetch-site same-origin :method GET Referer https://demoaffiliate.xyz/rasidate/amo/ User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers date Tue, 01 Jun 2021 16:48:17 GMT x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 127775 alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 content-length 72509 cf-request-id 0a6a12e85900002484b6343000000001 last-modified Mon, 31 May 2021 00:39:58 GMT server cloudflare x-frame-options SAMEORIGIN etag "60b4305e-11b3d" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=Zs7%2BvadrrPiAT2SAE4XE58J01oZCgG6YXaVRO2PJoJOZbXCWogfF874a9suhIaCt2XZHFQ2xV9ZTuITaRssnnx2n6iu0OKFB7aQ7xAbh6RDr13kWnjlifaEQzraEoMRhdVhthttteV2C7DQ%3D"}],"group":"cf-nel","max_age":604800} content-type image/png x-xss-protection 1; mode=block cache-control public, max-age=2592000 accept-ranges bytes cf-ray 6589edba2d782484-FRA expires Wed, 30 Jun 2021 05:18:41 GMT
GET H3-29	200	m22.png demoaffiliate.xyz/rasidate/amo/cap/	2 MB 2 MB	49ms 37ms	Image image/png	2606:4700:3037::ac43:dd8b CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://demoaffiliate.xyz/rasidate/amo/cap/m22.png Requested by Host: demoaffiliate.xyz URL: https://demoaffiliate.xyz/rasidate/amo/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3037::ac43:dd8b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a46d0f72aa2bb07f59172949833e34521711c304cb902e200f059cbde189e16c Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /rasidate/amo/cap/m22.png pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority demoaffiliate.xyz referer https://demoaffiliate.xyz/rasidate/amo/ :scheme https sec-fetch-site same-origin :method GET Referer https://demoaffiliate.xyz/rasidate/amo/ User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers date Tue, 01 Jun 2021 16:48:17 GMT x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 128610 alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 content-length 2558621 cf-request-id 0a6a12e86000002484e3bee000000001 last-modified Mon, 31 May 2021 00:39:58 GMT server cloudflare x-frame-options SAMEORIGIN etag "60b4305e-270a9d" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=Ta6hJVwqoCujqnRqeEJ6hBEQoQTSJHMTAWYLawDW0AU9BbxqDLnG5WxnzkkndClhp7x9YoP%2FXH0FHwnr7RKdS0BfCK0ofN0r7KSgNQsQN7OCl52KT6V7nhY%2FkztDMU2Z3nNzxw%2B4CBjho9Q%3D"}],"group":"cf-nel","max_age":604800} content-type image/png x-xss-protection 1; mode=block cache-control public, max-age=2592000 accept-ranges bytes cf-ray 6589edba2d7b2484-FRA expires Wed, 30 Jun 2021 05:04:47 GMT
GET H2	200	jquery-3.4.1.slim.min.js Show response code.jquery.com/	69 KB 24 KB	24ms 8ms	Script application/javascript	2001:4de0:ac18::1:a:3a HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.4.1.slim.min.js Requested by Host: demoaffiliate.xyz URL: https://demoaffiliate.xyz/rasidate/amo/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:3a , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash a5ab2a00a0439854f8787a0dda775dea5377ef4905886505c938941d6854ee4f Request headers Origin https://demoaffiliate.xyz Referer https://demoaffiliate.xyz/ User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers date Tue, 01 Jun 2021 16:48:16 GMT content-encoding gzip last-modified Wed, 01 May 2019 21:14:27 GMT server nginx etag W/"5cca0c33-1157d" vary Accept-Encoding x-hw 1622566096.dop227.fr8.t,1622566096.cds214.fr8.hc,1622566096.cds260.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 24328
GET H2	200	popper.min.js Show response cdn.jsdelivr.net/npm/popper.js@1.16.0/dist/umd/	21 KB 7 KB	8ms 6ms	Script application/javascript	2a04:4e42:3::621 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/popper.js@1.16.0/dist/umd/popper.min.js Requested by Host: demoaffiliate.xyz URL: https://demoaffiliate.xyz/rasidate/amo/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::621 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash c776195ad46333c6c9a9fe3c74502ffea9a02faf122388ea3567922cc65a3060 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Origin https://demoaffiliate.xyz Referer https://demoaffiliate.xyz/ User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff age 9654543 x-cache HIT cross-origin-resource-policy cross-origin content-length 7510 etag W/"5309-YvI45zNIx3656GVCan0bfeI8uy0" x-served-by cache-fra19153-FRA date Tue, 01 Jun 2021 16:48:16 GMT vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable accept-ranges bytes timing-allow-origin *
GET H2	200	bootstrap.min.js Show response stackpath.bootstrapcdn.com/bootstrap/4.4.1/js/	59 KB 15 KB	34ms 31ms	Script application/javascript	2606:4700::6812:acf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.4.1/js/bootstrap.min.js Requested by Host: demoaffiliate.xyz URL: https://demoaffiliate.xyz/rasidate/amo/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5aa53525abc5c5200c70b3f6588388f86076cd699284c23cda64e92c372a1548 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Origin https://demoaffiliate.xyz Referer https://demoaffiliate.xyz/ User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers date Tue, 01 Jun 2021 16:48:16 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 601, 617, 617 age 123665 cdn-cachedat 2021-05-31 05:21:33 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 cf-request-id 0a6a12e84e0000dff36308d000000001 timing-allow-origin * access-control-allow-origin * last-modified Mon, 25 Jan 2021 22:04:09 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid 1ec58032f4771c295de696408cc651c8 cf-ray 6589edba18efdff3-FRA cdn-requestcountrycode DE cdn-requestpullsuccess True

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banque Postale (Banking)

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery function| Popper object| bootstrap function| clavier

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

atgence.com
cdn.jsdelivr.net
code.jquery.com
demoaffiliate.xyz
stackpath.bootstrapcdn.com
2001:4de0:ac18::1:a:3a
2606:4700:3037::ac43:dd8b
2606:4700::6812:acf
2a04:4e42:3::621
46.16.200.89
08ac96cbcdec9ec14e257b53d9bfae5ff8d6e233a9bed2d0beab49082b267f97
2ff5b959fa9f6b4b1d04d20a37d706e90039176ab1e2a202994d9580baeebfd6
5aa53525abc5c5200c70b3f6588388f86076cd699284c23cda64e92c372a1548
64b4218d348251d7d1ad663d73fba55ba6c4f40889de5f7d6eb56121603e09c5
7c4ee816e44f918103b472b9f25f8d6cca02ee7deda0df72b24b358790a760c8
8138be10ba8f34b704e48bf0291317e7de8c0892fd00ee1ef1a1696b1ea5ccab
8c8014b809bdfd98c022805c1b412488e84576b649c67094e1cd8f1a2d9ccc97
9530f9c073d339831cf2491e1354b3be23474cc21a01652c23591d7470b85e97
a46d0f72aa2bb07f59172949833e34521711c304cb902e200f059cbde189e16c
a5ab2a00a0439854f8787a0dda775dea5377ef4905886505c938941d6854ee4f
c776195ad46333c6c9a9fe3c74502ffea9a02faf122388ea3567922cc65a3060