fl2.charismaticbreathtakingclick.shop Open in urlscan Pro
2606:4700:3035::ac43:b908 Public Scan

Go To Rescan
Add Verdict Report

URL:
http://fl2.charismaticbreathtakingclick.shop/wbpage2/mob-cont-unp/index-fr.html?td=www.thebuxfiles.com&cep=wz3vh-jwdx_ffptqs3_-rewmgizvx_tdo9...
Submission: On January 23 via api (January 23rd 2024, 1:06:56 am UTC) from US — Scanned from US

Summary HTTP 4 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 4 HTTP transactions. The main IP is 2606:4700:3035::ac43:b908, located in United States and belongs to CLOUDFLARENET, US. The main domain is fl2.charismaticbreathtakingclick.shop.

This is the only time fl2.charismaticbreathtakingclick.shop was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	2606:4700:303... 2606:4700:3035::ac43:b908	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	139.45.197.251 139.45.197.251	9002 (RETN-AS) (RETN-AS)
4	3

2 2606:4700:3035::ac43:b908 (United States)

ASN13335 (CLOUDFLARENET, US)

fl2.charismaticbreathtakingclick.shop	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 139.45.197.251 (United Kingdom)

ASN9002 (RETN-AS, GB)

gauvaiho.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	gauvaiho.net gauvaiho.net — Cisco Umbrella Rank: 177449	12 KB
2	charismaticbreathtakingclick.shop fl2.charismaticbreathtakingclick.shop	10 KB
4	2

	Domain	Requested by
2	gauvaiho.net	fl2.charismaticbreathtakingclick.shop gauvaiho.net
2	fl2.charismaticbreathtakingclick.shop	gauvaiho.net
4	2

This site contains no links.

Subject Issuer	Validity	Valid
gauvaiho.net R3	`2023-11-11` - `2024-02-09`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://fl2.charismaticbreathtakingclick.shop/wbpage2/mob-cont-unp/index-fr.html?td=www.thebuxfiles.com&cep=wz3vh-jwdx_ffptqs3_-rewmgizvx_tdo9-ty_yx5hd0ppz3se9y-buhaamdppg214ttkkapvb79rkljxcgqk7m2nocslfexzv1wjfk5spwtyahogymz__xt-hpdwnccrpml9rdqktdukwxjsg3fyzdcjb7kl8sqqx_drkaitn...%20312%20...268709990tnctv419171722994v2a
Frame ID: 353F48649AE45C8539A0DE8577809C37
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Attention...

Page Statistics

4
Requests

25 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

22 kB
Transfer

53 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
10 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request index-fr.html Show response
fl2.charismaticbreathtakingclick.shop/wbpage2/mob-cont-unp/ 21 KB
9 KB 103ms
59ms Document
text/html 2606:4700:3035::ac43:b908
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://fl2.charismaticbreathtakingclick.shop/wbpage2/mob-cont-unp/index-fr.html?td=www.thebuxfiles.com&cep=wz3vh-jwdx_ffptqs3_-rewmgizvx_tdo9-ty_yx5hd0ppz3se9y-buhaamdppg214ttkkapvb79rkljxcgqk7m2nocslfexzv1wjfk5spwtyahogymz__xt-hpdwnccrpml9rdqktdukwxjsg3fyzdcjb7kl8sqqx_drkaitn...%20312%20...268709990tnctv419171722994v2a
Protocol: HTTP/1.1
Server: 2606:4700:3035::ac43:b908 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c025a413d93558b1d1d839666c5c6b38522e3457e7824091a00fcb0f3e11fd8d

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Access-Control-Allow-Origin: *
CF-Cache-Status: DYNAMIC
CF-RAY: 849c22efdad274b0-MIA
Cache-Control: max-age=604800
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Tue, 23 Jan 2024 01:06:51 GMT
Expires: Tue, 30 Jan 2024 01:06:51 GMT
Last-Modified: Sat, 15 Jul 2023 02:23:38 GMT
Link: <https://sec.movienightowl.com/wbpage2/mob-cont-unp/index-fr.html?td=www.thebuxfiles.com&cep=wz3vh-jwdx_ffptqs3_-rewmgizvx_tdo9-ty_yx5hd0ppz3se9y-buhaamdppg214ttkkapvb79rkljxcgqk7m2nocslfexzv1wjfk5spwtyahogymz__xt-hpdwnccrpml9rdqktdukwxjsg3fyzdcjb7kl8sqqx_drkaitn...%20312%20...268709990tnctv419171722994v2a>; rel="canonical"
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rDv91C9BAmyE2fnaZNNpZDkfbEUPzLqxNS0ayZl6GpiQ87SOnqxCFq8OexCO9323GVGYbePWTp0g3LGiBXR0Tk8Rt8US74ViOrMzt3f1vJ0xEP5vZABst6bzxP9MTq3ycnNkFQikVBIM1hJYRjkRGExsXKxBTMy3127Gi3NeOaK5Axze"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Cache: HIT
X-Edge-Location: usmi
alt-svc: h3=":443"; ma=86400

GET
H/1.1 200
OK micro.tag.min.js Show response
gauvaiho.net/pfe/current/ 26 KB
11 KB 629ms
488ms Script
application/javascript 139.45.197.251
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://gauvaiho.net/pfe/current/micro.tag.min.js?z=4984707&sw=/sw-check-permissions-4eee0.js
Requested by: Host: fl2.charismaticbreathtakingclick.shop
URL: http://fl2.charismaticbreathtakingclick.shop/wbpage2/mob-cont-unp/index-fr.html?td=www.thebuxfiles.com&cep=wz3vh-jwdx_ffptqs3_-rewmgizvx_tdo9-ty_yx5hd0ppz3se9y-buhaamdppg214ttkkapvb79rkljxcgqk7m2nocslfexzv1wjfk5spwtyahogymz__xt-hpdwnccrpml9rdqktdukwxjsg3fyzdcjb7kl8sqqx_drkaitn...%20312%20...268709990tnctv419171722994v2a
Protocol: HTTP/1.1
Server: 139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: nginx /
Resource Hash: 73bb863239e7deafca0188b7a37efed56fec31a9f71d33cf253793c1e2738a34

Request headers

accept-language: en-US,en;q=0.9
Referer: http://fl2.charismaticbreathtakingclick.shop/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 23 Jan 2024 01:06:51 GMT
Content-Encoding: gzip
Last-Modified: Thu, 18 Jan 2024 08:49:51 GMT
Server: nginx
ETag: W/"65a8e62f-69d0"
Transfer-Encoding: chunked
Content-Type: application/javascript
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive

GET
DATA 200
OK truncated
/ 505 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c18cf1c9c9835639266fd6a326445c9a70e3945b96c48fe7a0d121f246fef57f

Request headers

accept-language: en-US,en;q=0.9
Referer: http://fl2.charismaticbreathtakingclick.shop/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 546 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c3eaacb6095b9393bff31d1283736e508be6aa1757871a939f8e05dd5d28096d

Request headers

accept-language: en-US,en;q=0.9
Referer: http://fl2.charismaticbreathtakingclick.shop/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 257 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9266cdc0615dc2954cfa3520e80439feb9289ef1f9a1fda4c027d72d376d63da

Request headers

accept-language: en-US,en;q=0.9
Referer: http://fl2.charismaticbreathtakingclick.shop/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 11bf036b35a56f3e07acdfeb44f3fa3dc79b9311826b278064df53da3934206b

Request headers

accept-language: en-US,en;q=0.9
Referer: http://fl2.charismaticbreathtakingclick.shop/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 167 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 61a55178ac488ed338207a5ae2b51c306b99ad98f56fe021b87cb0cdb1d11873

Request headers

accept-language: en-US,en;q=0.9
Referer: http://fl2.charismaticbreathtakingclick.shop/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 260 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5c5d272a86f778759b20c0147732ee3f29c1cf0cc819ebfbfe42f38413274fd9

Request headers

accept-language: en-US,en;q=0.9
Referer: http://fl2.charismaticbreathtakingclick.shop/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 815 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7559db0de40a038696a5c79b46f52d52c248ddab9474efff93f2cd13a8b29351

Request headers

accept-language: en-US,en;q=0.9
Referer: http://fl2.charismaticbreathtakingclick.shop/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 385 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d110d061f374ba5b804fafc33fe58941b8d35f92db15cb4bd4636e9f1373012d

Request headers

accept-language: en-US,en;q=0.9
Referer: http://fl2.charismaticbreathtakingclick.shop/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 564 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 86ab9312c0e096cb380a9c70829354fe410bef3c0f7f56fb29baf0a0ca0ea070

Request headers

accept-language: en-US,en;q=0.9
Referer: http://fl2.charismaticbreathtakingclick.shop/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 638 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 09099cad6053aa2e61de63f84e595d7a10209be82aa904638bbb93479b9c3f3c

Request headers

accept-language: en-US,en;q=0.9
Referer: http://fl2.charismaticbreathtakingclick.shop/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H/1.1 200
OK sw-check-permissions-4eee0.js
fl2.charismaticbreathtakingclick.shop/ 0
1 KB 40ms
40ms Other
application/javascript 2606:4700:3035::ac43:b908
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://fl2.charismaticbreathtakingclick.shop/sw-check-permissions-4eee0.js?zoneId=4984707
Requested by: Host: gauvaiho.net
URL: http://gauvaiho.net/pfe/current/micro.tag.min.js?z=4984707&sw=/sw-check-permissions-4eee0.js
Protocol: HTTP/1.1
Server: 2606:4700:3035::ac43:b908 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: http://fl2.charismaticbreathtakingclick.shop/wbpage2/mob-cont-unp/index-fr.html?td=www.thebuxfiles.com&cep=wz3vh-jwdx_ffptqs3_-rewmgizvx_tdo9-ty_yx5hd0ppz3se9y-buhaamdppg214ttkkapvb79rkljxcgqk7m2nocslfexzv1wjfk5spwtyahogymz__xt-hpdwnccrpml9rdqktdukwxjsg3fyzdcjb7kl8sqqx_drkaitn...%20312%20...268709990tnctv419171722994v2a
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date: Tue, 23 Jan 2024 01:06:52 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Age: 489514
X-Edge-Location: usmi
Cf-Polished: origSize=566
Transfer-Encoding: chunked
X-Cache: HIT
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
Cf-Bgj: minify
Last-Modified: Wed, 04 May 2022 10:33:35 GMT
Server: cloudflare
ETag: W/"236-5de2d285fa983"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QqrdFo1M2dsblqhlOe5Hm2QDDx80vTqi0jRBLA%2Bxiw5FYTnks3%2FT5wJwskfgNPa2goB%2Fx05db2e2QMGdfoQZxA8nhe6k0%2B9N0saDJrAb49eGAiZdIytpwxA1alr27KdOttTs2m5XcbpxQ42cm%2BYEEW9bExofQwFSi8y%2FC9Mb7pR1DlW6"}],"group":"cf-nel","max_age":604800}
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=604800
CF-RAY: 849c22f46ccb74b0-MIA
Link: <https://sec.movienightowl.com/sw-check-permissions-4eee0.js?zoneId=4984707>; rel="canonical"
Expires: Wed, 24 Jan 2024 09:08:18 GMT

POST
H2 200 zone
gauvaiho.net/ 0
273 B 417ms
131ms Ping
text/plain 139.45.197.251
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://gauvaiho.net/zone?&pub=0&zone_id=4984707&is_mobile=false&domain=fl2.charismaticbreathtakingclick.shop&var=&ymid=&var_3=&var_4=&dsig=&tg=1&sw=3.1.474&action=prerequest

Requested by

Host: gauvaiho.net
URL: http://gauvaiho.net/pfe/current/micro.tag.min.js?z=4984707&sw=/sw-check-permissions-4eee0.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: http://fl2.charismaticbreathtakingclick.shop/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-trace-id: 38391be1920d4587e8d9371f85304835
date: Tue, 23 Jan 2024 01:06:52 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
server: nginx
access-control-allow-origin: http://fl2.charismaticbreathtakingclick.shop
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, X-Oaid, Content-Type, Accept
content-length: 0

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fl2.charismaticbreathtakingclick.shop
gauvaiho.net
139.45.197.251
2606:4700:3035::ac43:b908
09099cad6053aa2e61de63f84e595d7a10209be82aa904638bbb93479b9c3f3c
11bf036b35a56f3e07acdfeb44f3fa3dc79b9311826b278064df53da3934206b
5c5d272a86f778759b20c0147732ee3f29c1cf0cc819ebfbfe42f38413274fd9
61a55178ac488ed338207a5ae2b51c306b99ad98f56fe021b87cb0cdb1d11873
73bb863239e7deafca0188b7a37efed56fec31a9f71d33cf253793c1e2738a34
7559db0de40a038696a5c79b46f52d52c248ddab9474efff93f2cd13a8b29351
86ab9312c0e096cb380a9c70829354fe410bef3c0f7f56fb29baf0a0ca0ea070
9266cdc0615dc2954cfa3520e80439feb9289ef1f9a1fda4c027d72d376d63da
c025a413d93558b1d1d839666c5c6b38522e3457e7824091a00fcb0f3e11fd8d
c18cf1c9c9835639266fd6a326445c9a70e3945b96c48fe7a0d121f246fef57f
c3eaacb6095b9393bff31d1283736e508be6aa1757871a939f8e05dd5d28096d
d110d061f374ba5b804fafc33fe58941b8d35f92db15cb4bd4636e9f1373012d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

fl2.charismaticbreathtakingclick.shop Open in urlscan Pro 2606:4700:3035::ac43:b908 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

4 Requests

25 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

22 kBTransfer

53 kBSize

0 Cookies

0 Outgoing links

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 10 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

0 Cookies

Indicators

fl2.charismaticbreathtakingclick.shop Open in urlscan Pro
2606:4700:3035::ac43:b908 Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

25 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

22 kB
Transfer

53 kB
Size

0
Cookies

4 HTTP transactions
10 data transactions