www.4x4slot.com Open in urlscan Pro
2a06:98c1:3120::3 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://jorac43755.systeme.io/3d9d71ef
Effective URL:
https://www.4x4slot.com/wp-admin/css/colors/coffee/aslian/dod/ba.php
Submission: On May 19 via manual (May 19th 2023, 12:17:37 pm UTC) from DE — Scanned from DE

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 7 IPs in 2 countries across 5 domains to perform 10 HTTP transactions. The main IP is 2a06:98c1:3120::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.4x4slot.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on February 26th 2023. Valid for: a year.

This is the only time www.4x4slot.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ING Group (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	108.138.17.106 108.138.17.106	16509 (AMAZON-02) (AMAZON-02)
1	2a04:4e42:600... 2a04:4e42:600::282	54113 (FASTLY) (FASTLY)
4	2600:9000:212... 2600:9000:2127:1000:1c:d937:ae40:93a1	16509 (AMAZON-02) (AMAZON-02)
1	52.92.32.0 52.92.32.0	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:212... 2600:9000:2127:3400:13:b2ca:a980:93a1	16509 (AMAZON-02) (AMAZON-02)
1 2	2a06:98c1:312... 2a06:98c1:3120::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	7

1 108.138.17.106 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-17-106.fra56.r.cloudfront.net

jorac43755.systeme.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:600::282 (United States)

ASN54113 (FASTLY, US)

cdn.polyfill.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:9000:2127:1000:1c:d937:ae40:93a1 (United States)

ASN16509 (AMAZON-02, US)

d3fit27i5nzkqh.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.92.32.0 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: s3-eu-west-1.amazonaws.com

s3.eu-west-1.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2127:3400:13:b2ca:a980:93a1 (United States)

ASN16509 (AMAZON-02, US)

editor.systeme.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a06:98c1:3120::3 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

www.4x4slot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	cloudfront.net d3fit27i5nzkqh.cloudfront.net	425 KB
2	4x4slot.com 1 redirects www.4x4slot.com	175 KB
2	systeme.io jorac43755.systeme.io editor.systeme.io — Cisco Umbrella Rank: 532245	18 KB
1	amazonaws.com s3.eu-west-1.amazonaws.com — Cisco Umbrella Rank: 3736	46 KB
1	polyfill.io cdn.polyfill.io — Cisco Umbrella Rank: 2715	674 B
10	5

	Domain	Requested by
4	d3fit27i5nzkqh.cloudfront.net	jorac43755.systeme.io
2	www.4x4slot.com	1 redirects www.4x4slot.com
1	editor.systeme.io	jorac43755.systeme.io
1	s3.eu-west-1.amazonaws.com	jorac43755.systeme.io
1	cdn.polyfill.io	jorac43755.systeme.io
1	jorac43755.systeme.io
10	6

This site contains no links.

Subject Issuer	Validity	Valid
systeme.io Amazon RSA 2048 M01	`2023-03-02` - `2024-01-24`	a year	crt.sh
polyfill.io GlobalSign Atlas R3 DV TLS CA 2022 Q4	`2022-12-10` - `2024-01-11`	a year	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2022-12-08` - `2023-12-07`	a year	crt.sh
*.s3-eu-west-1.amazonaws.com Amazon RSA 2048 M01	`2023-04-11` - `2023-12-23`	8 months	crt.sh
editor.systeme.io Amazon RSA 2048 M01	`2023-02-20` - `2023-09-27`	7 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-02-26` - `2024-02-25`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.4x4slot.com/wp-admin/css/colors/coffee/aslian/dod/ba.php
Frame ID: 53A97799040D49F1A1D152D98B5F5435
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

ING Login

Page URL History Show full URLs

https://jorac43755.systeme.io/3d9d71ef Page URL
https://www.4x4slot.com/wp-admin/css/colors/coffee/aslian/dod/ HTTP 302
https://www.4x4slot.com/wp-admin/css/colors/coffee/aslian/dod/ba.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Polyfill (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/polyfill\.min\.js

Page Statistics

10
Requests

90 %
HTTPS

67 %
IPv6

5
Domains

6
Subdomains

7
IPs

2
Countries

755 kB
Transfer

2363 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://jorac43755.systeme.io/3d9d71ef Page URL
https://www.4x4slot.com/wp-admin/css/colors/coffee/aslian/dod/ HTTP 302
https://www.4x4slot.com/wp-admin/css/colors/coffee/aslian/dod/ba.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
6 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 3d9d71ef Show response
jorac43755.systeme.io/ 21 KB
7 KB 175ms
102ms Document
text/html 108.138.17.106
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://jorac43755.systeme.io/3d9d71ef

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.138.17.106 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-17-106.fra56.r.cloudfront.net

Software

nginx/1.24.0 /

Resource Hash

9fa1dbf1ba00dd1589fd0953db60a9decff1f2c78f174d877d4fff56404f806a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=0, must-revalidate, private
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Fri, 19 May 2023 12:17:32 GMT
expires: Fri, 19 May 2023 12:17:32 GMT
server: nginx/1.24.0
vary: Accept-Encoding
via: 1.1 4a0b7683a1d33d6d186965e831f2de96.cloudfront.net (CloudFront)
x-amz-cf-id: y9jUM4_dpW-7p7xttBPS0qofnIBbWKegch-k3mkuEQSCCqewKfBkEg==
x-amz-cf-pop: FRA56-P7
x-cache: Miss from cloudfront
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 polyfill.min.js Show response
cdn.polyfill.io/v2/ 100 B
674 B 53ms
8ms Script
text/javascript 2a04:4e42:600::282
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.polyfill.io/v2/polyfill.min.js?features=Intl.~locale.en%2CmatchMedia

Requested by

Host: jorac43755.systeme.io
URL: https://jorac43755.systeme.io/3d9d71ef

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::282 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

34e4e4e998d1023cadeeda959be0f4fce5abe4eaf9d241782ae404e36446ecbf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jorac43755.systeme.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubdomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 19 May 2023 12:17:32 GMT
age: 1214767
detected-user-agent: Chrome Mobile/113.0.0
useragent_normaliser: chrome/113.0.0
server-timing: HIT, fastly;desc="Edge time";dur=1
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 113
referrer-policy: origin-when-cross-origin
last-modified: Wed, 03 May 2023 00:17:37 GMT
fastly_service_version: 195
vary: User-Agent, Accept-Encoding
access-control-allow-methods: GET,HEAD,OPTIONS
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
normalized-user-agent: chrome/113.0.0
cache-control: public, s-maxage=31536000, max-age=604800, stale-while-revalidate=604800, stale-if-error=604800
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 all.min.css
d3fit27i5nzkqh.cloudfront.net/assets/css/ 486 KB
80 KB 71ms
40ms Stylesheet
text/css 2600:9000:2127:1000:1c:d937:ae40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d3fit27i5nzkqh.cloudfront.net/assets/css/all.min.css
Requested by: Host: jorac43755.systeme.io
URL: https://jorac43755.systeme.io/3d9d71ef
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2127:1000:1c:d937:ae40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a35f901d01118e5649091bd03ac5784a7db52e111fb3806524c412f3d1dcfc5d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jorac43755.systeme.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Sat, 22 Apr 2023 15:56:45 GMT
content-encoding: br
via: 1.1 f3303a5632dc925c26253530523fa328.cloudfront.net (CloudFront)
last-modified: Wed, 18 May 2022 12:25:57 GMT
server: AmazonS3
x-amz-cf-pop: PRG50-C1
age: 2319648
etag: W/"325672b036bab9b57f6873aed5eccc43"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
cache-control: max-age=31536000,public
x-amz-cf-id: zzMkc8M7FPAFeputuhb5l1Ae9_H_CkuS068EEy0OPgqNBFQ1qlky_g==

GET
H2 200 runtimeSimplePage.6525755ed16e40f11e2f.js Show response
d3fit27i5nzkqh.cloudfront.net/js/ 2 KB
1 KB 39ms
10ms Script
application/javascript 2600:9000:2127:1000:1c:d937:ae40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d3fit27i5nzkqh.cloudfront.net/js/runtimeSimplePage.6525755ed16e40f11e2f.js
Requested by: Host: jorac43755.systeme.io
URL: https://jorac43755.systeme.io/3d9d71ef
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2127:1000:1c:d937:ae40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e6e6bcec8cf0fab66c48aea5ba1e6cfa240580212d714019a81493caad1c2b99

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jorac43755.systeme.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 11 Apr 2023 18:42:21 GMT
content-encoding: br
via: 1.1 f3303a5632dc925c26253530523fa328.cloudfront.net (CloudFront)
last-modified: Fri, 07 Apr 2023 10:58:12 GMT
server: AmazonS3
x-amz-cf-pop: PRG50-C1
age: 3260112
etag: W/"7e48280fb388cda9c9571931b0370d17"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=31536000,public
x-amz-cf-id: gHeqQRIc6uG0wNGyrzfTWjZrqlkaqn5Ss7iVWrfPiWXv7VqyUP3VHA==

GET
H2 200 simplePage.be8622030c9bc0fc2535.js Show response
d3fit27i5nzkqh.cloudfront.net/js/ 488 KB
97 KB 42ms
14ms Script
application/javascript 2600:9000:2127:1000:1c:d937:ae40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d3fit27i5nzkqh.cloudfront.net/js/simplePage.be8622030c9bc0fc2535.js
Requested by: Host: jorac43755.systeme.io
URL: https://jorac43755.systeme.io/3d9d71ef
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2127:1000:1c:d937:ae40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c954a07ca09a81c284428b60b1fed02217dfc91f50d8c069dcb9f11279e20e67

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jorac43755.systeme.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 16 May 2023 11:44:35 GMT
content-encoding: gzip
via: 1.1 f3303a5632dc925c26253530523fa328.cloudfront.net (CloudFront)
last-modified: Tue, 16 May 2023 11:44:29 GMT
server: AmazonS3
x-amz-cf-pop: PRG50-C1
age: 261178
etag: W/"4e3a7a2437630743d4cc1e43d55071de"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=31536000,public
x-amz-cf-id: ODWggouiTpx2s0al38qCmeH_ZsLq8Qg4V-TtoQmKg14ZP4oiDUZZUg==

GET
H2 200 vendors~simplePage.1fb37d24bdd9e96a0de1.js Show response
d3fit27i5nzkqh.cloudfront.net/js/ 845 KB
247 KB 56ms
28ms Script
application/javascript 2600:9000:2127:1000:1c:d937:ae40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d3fit27i5nzkqh.cloudfront.net/js/vendors~simplePage.1fb37d24bdd9e96a0de1.js
Requested by: Host: jorac43755.systeme.io
URL: https://jorac43755.systeme.io/3d9d71ef
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2127:1000:1c:d937:ae40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f5c6aae10644f6795f7f6ce1d1fdca28f1b3ced34ac660b1ae53c2bab0b88462

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jorac43755.systeme.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 01 May 2023 13:10:08 GMT
content-encoding: gzip
via: 1.1 f3303a5632dc925c26253530523fa328.cloudfront.net (CloudFront)
last-modified: Mon, 01 May 2023 13:10:01 GMT
server: AmazonS3
x-amz-cf-pop: PRG50-C1
age: 1552045
etag: W/"b2bc303c095b22a0cc7f837ed711d581"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=31536000,public
x-amz-cf-id: IP9cKYJb_D3Z78CalrTr95vHO2QbyVFyO_ReVhCt0wPcq5S8GdSdCg==

GET
H/1.1 200
OK 700.woff2
s3.eu-west-1.amazonaws.com/shared.systeme.io/fonts/google-fonts/poppins/ 46 KB
46 KB 124ms
42ms Font
font/woff2 52.92.32.0
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s3.eu-west-1.amazonaws.com/shared.systeme.io/fonts/google-fonts/poppins/700.woff2
Requested by: Host: jorac43755.systeme.io
URL: https://jorac43755.systeme.io/3d9d71ef
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.92.32.0 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-eu-west-1.amazonaws.com
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://jorac43755.systeme.io/
Origin: https://jorac43755.systeme.io
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Date: Fri, 19 May 2023 12:17:33 GMT
Last-Modified: Fri, 14 Apr 2023 06:25:01 GMT
Server: AmazonS3
x-amz-request-id: C4EK1K16G5W1SJEF
ETag: "5aaac6882d1f2196e64d57c618cdb821"
x-amz-server-side-encryption: AES256
Access-Control-Max-Age: 31536000
Vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Content-Type: font/woff2
Accept-Ranges: bytes
Content-Length: 46932
x-amz-id-2: aXXHshEOo/torIQJZnQAj4UeIeaMsyiRDiVRc5/Dz0cYxFCIn/BjF4jgulQOvnve0uJNkOFZbwU=

GET
H2 200 affiliate_badge_logo.png
editor.systeme.io/assets/images/ 10 KB
11 KB 77ms
10ms Image
image/png 2600:9000:2127:3400:13:b2ca:a980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://editor.systeme.io/assets/images/affiliate_badge_logo.png
Requested by: Host: jorac43755.systeme.io
URL: https://jorac43755.systeme.io/3d9d71ef
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2127:3400:13:b2ca:a980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jorac43755.systeme.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 18 May 2023 14:58:56 GMT
via: 1.1 9ed2eeec8748ea461af0d1cbf998da0e.cloudfront.net (CloudFront)
last-modified: Thu, 18 May 2023 14:58:31 GMT
server: AmazonS3
x-amz-cf-pop: PRG50-C1
age: 76717
etag: "8ef4308d7726d4ff8621170e787130ed"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: image/png
cache-control: max-age=31536000,public
accept-ranges: bytes
content-length: 10472
x-amz-cf-id: H9NB9j-vopM82IJfeUayiZTEs0zQdyuuNZ9VhSCQ31rXzVbC458OQA==

GET
H2

200

Primary Request ba.php Show response
www.4x4slot.com/wp-admin/css/colors/coffee/aslian/dod/
Redirect Chain

https://www.4x4slot.com/wp-admin/css/colors/coffee/aslian/dod/
https://www.4x4slot.com/wp-admin/css/colors/coffee/aslian/dod/ba.php

313 KB
175 KB

212ms
211ms

Document
text/html

2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.4x4slot.com/wp-admin/css/colors/coffee/aslian/dod/ba.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cb812769dbdd4e4cefc8b6618951f64a5952b48cfd9cb5855f62de09d7cce0e6

Request headers

Referer: https://jorac43755.systeme.io/3d9d71ef
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7c9c47094d841e6c-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Fri, 19 May 2023 12:17:33 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S%2FEoyP8cnBu1WRa1tA9VIzUjRD4%2B0wwhPos3IqWWNhlXgkfLweZVlsqwL%2BMGq03a50i2qWv3FvY1f%2BqCWAEoJV90CT1PeEK1l6niDMZG5xrqOLkcRT%2BtU2lfi6mwA11Z68Ajo0UdLbG3j72e7%2Bs%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7c9c47053ef91e6c-FRA
content-type: text/html; charset=UTF-8
date: Fri, 19 May 2023 12:17:33 GMT
location: ba.php
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OjLgkqGbUs9LPFPwy4s1ILbVGNcdWrhyUSnpDcbEAR8AXCPt2DckdyhAt61j%2FOkIAsNCUusRn4K5V%2Bz%2Fdt%2BrVOUvRhTUnPO5AFuyTdT%2BXr7HGcbXWuv0wLw6m%2BmxKspzC9naxfG5OYdqGUx12Hw%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1470546a5f8d7a68deb045a9f3be48c3fa818c53c0b4f8c854d6acdec64aa225

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 16 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9a214e9df938fbc09d96e47ae4dbe031d7a581647a87c38ec371bc2a2d4dc7cf

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 30 KB
30 KB Font
application/octet-stream

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3a135f82b209a59959b162a1fbc9b0b38856d1332af286f86046b06357b3811e

Request headers

Referer
Origin: https://www.4x4slot.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Content-Type: application/octet-stream

GET
DATA 200
OK truncated
/ 29 KB
29 KB Font
application/octet-stream

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f74c344733a85af20d2754b208f12309e2a30c591795d0881cb0ad94c4be6155

Request headers

Referer
Origin: https://www.4x4slot.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Content-Type: application/octet-stream

GET
DATA 200
OK truncated
/ 32 KB
32 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 305948d72ce8577a386f77079dacdb6841f18668f64cc7865a196a0624e5b5a8

Request headers

Referer
Origin: https://www.4x4slot.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Content-Type: application/font-woff

GET
DATA 200
OK truncated
/ 44 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fb6ebe23316c03fd8d25e871bfdd9c41eb77e14115f5a01e3e0d97b94617779e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Content-Type: image/png

GET email-decode.min.js
www.4x4slot.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.4x4slot.com
URL: https://www.4x4slot.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ING Group (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 boolean| credentialless

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			jorac43755.systeme.io/	1969-12-31 23:59:59	Name: user Value: e71l14sac7v0hlhjen3t43r9am
			jorac43755.systeme.io/	1970-01-20 21:30:58	Name: v Value: 8a7bd3d19a34c26a6ece2a9d4c5795f07acf0e0cb6dd7683eadf8a846131b7e8

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://www.4x4slot.com/wp-admin/css/colors/coffee/aslian/dod/ba.php Message: Refused to load the script 'https://www.4x4slot.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js' because it violates the following Content Security Policy directive: "script-src 'unsafe-inline' data:". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.polyfill.io
d3fit27i5nzkqh.cloudfront.net
editor.systeme.io
jorac43755.systeme.io
s3.eu-west-1.amazonaws.com
www.4x4slot.com
www.4x4slot.com
108.138.17.106
2600:9000:2127:1000:1c:d937:ae40:93a1
2600:9000:2127:3400:13:b2ca:a980:93a1
2a04:4e42:600::282
2a06:98c1:3120::3
52.92.32.0
1470546a5f8d7a68deb045a9f3be48c3fa818c53c0b4f8c854d6acdec64aa225
305948d72ce8577a386f77079dacdb6841f18668f64cc7865a196a0624e5b5a8
34e4e4e998d1023cadeeda959be0f4fce5abe4eaf9d241782ae404e36446ecbf
3a135f82b209a59959b162a1fbc9b0b38856d1332af286f86046b06357b3811e
9a214e9df938fbc09d96e47ae4dbe031d7a581647a87c38ec371bc2a2d4dc7cf
9fa1dbf1ba00dd1589fd0953db60a9decff1f2c78f174d877d4fff56404f806a
a35f901d01118e5649091bd03ac5784a7db52e111fb3806524c412f3d1dcfc5d
c954a07ca09a81c284428b60b1fed02217dfc91f50d8c069dcb9f11279e20e67
cb812769dbdd4e4cefc8b6618951f64a5952b48cfd9cb5855f62de09d7cce0e6
e6e6bcec8cf0fab66c48aea5ba1e6cfa240580212d714019a81493caad1c2b99
f5c6aae10644f6795f7f6ce1d1fdca28f1b3ced34ac660b1ae53c2bab0b88462
f74c344733a85af20d2754b208f12309e2a30c591795d0881cb0ad94c4be6155
fb6ebe23316c03fd8d25e871bfdd9c41eb77e14115f5a01e3e0d97b94617779e

www.4x4slot.com Open in urlscan Pro 2a06:98c1:3120::3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

10 Requests

90 %HTTPS

67 %IPv6

5 Domains

6 Subdomains

7 IPs

2 Countries

755 kBTransfer

2363 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

2 Cookies

1 Console Messages

Security Headers

Indicators

www.4x4slot.com Open in urlscan Pro
2a06:98c1:3120::3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

90 %
HTTPS

67 %
IPv6

5
Domains

6
Subdomains

7
IPs

2
Countries

755 kB
Transfer

2363 kB
Size

2
Cookies

10 HTTP transactions
6 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!