payment.cristalinolodge.com.br Open in urlscan Pro
192.240.179.83 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://payment.cristalinolodge.com.br/
Submission: On August 01 via automatic, source certstream-suspicious (August 1st 2024, 7:04:52 am UTC) — Scanned from DE

Summary HTTP 13 Redirects Links 20 Behaviour Indicators

Summary

This website contacted 5 IPs in 4 countries across 3 domains to perform 13 HTTP transactions. The main IP is 192.240.179.83, located in United States and belongs to NEXCESS-NET, US. The main domain is payment.cristalinolodge.com.br.
TLS certificate: Issued by R11 on July 28th 2024. Valid for: 3 months.

This is the only time payment.cristalinolodge.com.br was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	192.240.179.83 192.240.179.83	36444 (NEXCESS-NET) (NEXCESS-NET)
6	104.18.22.80 104.18.22.80	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	146.75.120.157 146.75.120.157	54113 (FASTLY) (FASTLY)
2	93.184.220.66 93.184.220.66	15133 (EDGECAST) (EDGECAST)
1	104.244.42.200 104.244.42.200	13414 (TWITTER) (TWITTER)
13	5

2 192.240.179.83 (United States)

ASN36444 (NEXCESS-NET, US)
PTR: eep2-06.nexcess.net

payment.cristalinolodge.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.18.22.80 (None, )

ASN13335 (CLOUDFLARENET, US)

smhttp-nex.nexcesscdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 146.75.120.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 93.184.220.66 (London, United Kingdom)

ASN15133 (EDGECAST, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.200 (United States)

ASN13414 (TWITTER, US)

syndication.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	nexcesscdn.net smhttp-nex.nexcesscdn.net	157 KB
5	twitter.com platform.twitter.com — Cisco Umbrella Rank: 1868 syndication.twitter.com — Cisco Umbrella Rank: 2285	30 KB
2	cristalinolodge.com.br payment.cristalinolodge.com.br	7 KB
13	3

	Domain	Requested by
6	smhttp-nex.nexcesscdn.net	payment.cristalinolodge.com.br smhttp-nex.nexcesscdn.net
4	platform.twitter.com	payment.cristalinolodge.com.br platform.twitter.com
2	payment.cristalinolodge.com.br
1	syndication.twitter.com
13	4

This site contains links to these domains. Also see Links.

Domain
www.nexcess.net
twitter.com
www.facebook.com
www.linkedin.com
plus.google.com
www.youtube.com
docs.nexcess.net

Subject Issuer	Validity	Valid
payment.cristalinolodge.com.br R11	`2024-07-28` - `2024-10-26`	3 months	crt.sh
nexcesscdn.net E6	`2024-07-28` - `2024-10-26`	3 months	crt.sh
*.twimg.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-21` - `2024-08-20`	a year	crt.sh
syndication.twitter.com R11	`2024-07-05` - `2024-10-03`	3 months	crt.sh

This page contains 3 frames:

Primary Page: https://payment.cristalinolodge.com.br/
Frame ID: 80E2B12F23FC1E990F2E2DAFA124C749
Requests: 11 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fpayment.cristalinolodge.com.br
Frame ID: 76853E68A4C7A64C43A2A83088DF00FA
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/tweet_button.2f70fb173b9000da126c79afe2098f02.en.html
Frame ID: 458F4D513D791696234FCDF4007BCFFD
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Nexcess

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Twitter (Widgets) Expand

Overall confidence: 100%
Detected patterns

//platform\.twitter\.com/widgets\.js

Page Statistics

13
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

5
IPs

4
Countries

194 kB
Transfer

434 kB
Size

0
Cookies

20 Outgoing links

These are links going to different origins than the main page.

URL: https://www.nexcess.net/

Search URL Search Domain Scan URL

URL: https://twitter.com/nexcess

Search URL Search Domain Scan URL

URL: https://www.facebook.com/nexcess

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/nexcess

Search URL Search Domain Scan URL

URL: https://plus.google.com/107971784894043504000/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/nexcessnet

Search URL Search Domain Scan URL

URL: https://www.nexcess.net/support
Title: Nexcess support

Search URL Search Domain Scan URL

URL: https://docs.nexcess.net/article/how-to-point-your-domain-name-to-nexcess-nameservers.html
Title: Pointing Your Domain Name

Search URL Search Domain Scan URL

URL: https://docs.nexcess.net/article/how-to-enable-ssh-access.html
Title: Enable SSH Access

Search URL Search Domain Scan URL

URL: https://docs.nexcess.net/article/how-to-transfer-files-to-a-server-with-sftp.html
Title: Using SFTP

Search URL Search Domain Scan URL

URL: https://docs.nexcess.net/article/adding-a-secondary-domain.html
Title: Adding a Secondary Domain

Search URL Search Domain Scan URL

URL: https://www.nexcess.net/magento/hosting
Title: Magento Hosting

Search URL Search Domain Scan URL

URL: https://www.nexcess.net/wordpress/hosting
Title: WordPress Hosting

Search URL Search Domain Scan URL

URL: https://www.nexcess.net/expressionengine/hosting
Title: ExpressionEngine Hosting

Search URL Search Domain Scan URL

URL: https://www.nexcess.net/hosting/shared
Title: Shared Hosting

Search URL Search Domain Scan URL

URL: https://www.nexcess.net/hosting/dedicated-servers
Title: Dedicated Hosting

Search URL Search Domain Scan URL

URL: https://www.nexcess.net/hosting/michigan-colocation
Title: Michigan Colocation

Search URL Search Domain Scan URL

URL: https://www.nexcess.net/services/ssl-certificates
Title: SSL Certificates

Search URL Search Domain Scan URL

URL: https://www.nexcess.net/services/domains
Title: Register A Domain

Search URL Search Domain Scan URL

URL: https://www.nexcess.net/services/content-delivery-network
Title: Content Delivery Network

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
payment.cristalinolodge.com.br/ 6 KB
6 KB 1404ms
115ms Document
text/html 192.240.179.83
NEXCESS-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://payment.cristalinolodge.com.br/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 192.240.179.83 , United States, ASN36444 (NEXCESS-NET, US),
Reverse DNS: eep2-06.nexcess.net
Software: Apache /
Resource Hash: 9019994903b6d05b2e75d7a4e13a150a79ffcde2ec0ea9f0f8cf78d687026d59

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Connection: Keep-Alive
Content-Length: 6324
Content-Type: text/html
Date: Thu, 01 Aug 2024 07:04:48 GMT
ETag: "18b4-5fd2a7b1f1f66"
Keep-Alive: timeout=5, max=100
Last-Modified: Fri, 02 Jun 2023 19:22:59 GMT
Server: Apache

GET
H3 200 bootstrap-3.3.2.min.css
smhttp-nex.nexcesscdn.net/803313/static/vten/css/ 114 KB
20 KB 101ms
26ms Stylesheet
text/css 104.18.22.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://smhttp-nex.nexcesscdn.net/803313/static/vten/css/bootstrap-3.3.2.min.css
Requested by: Host: payment.cristalinolodge.com.br
URL: https://payment.cristalinolodge.com.br/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.22.80 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d31bef450ee67b64f9b70bfdf41fe4e00c65438705cc1fbb48ea6026d3a5d697

Request headers

Referer: https://payment.cristalinolodge.com.br/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 07:04:48 GMT
x-amz-version-id: GUMp_jqo5T3syINmNBcAnpefBrcWA9g_
via: 1.1 42fa987334e4ecfd52be3ba1803e9b82.cloudfront.net (CloudFront)
x-edge-region: us-midwest-1
cf-cache-status: HIT
x-amz-cf-pop: ORD56-P6
age: 6823
content-encoding: br
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400
x-request-id: req-19992-1720416597.908-203.78.168.3-453-0-
last-modified: Fri, 17 Sep 2021 18:49:03 GMT
server: cloudflare
x-amz-meta-s3cmd-attrs: atime:1425655886/ctime:1425655886/gid:1005/gname:nexcessn/md5:58a49b3689d699cb72ffda7252d99fcb/mode:33188/mtime:1421676202/uid:1001/uname:nexcessn
etag: W/"58a49b3689d699cb72ffda7252d99fcb"
vary: Accept-Encoding
x-edge-server: eadn-wc01-dtw
content-type: text/css
access-control-allow-origin: *
x-edge: STALE
cache-control: public, max-age=172800
cf-ray: 8ac3f9e63e994d88-FRA
x-amz-cf-id: 9qiG03bpNIxCNatlPGCIGQXZTXaMbnyJIXWKITNynipDU9ErjIR_ig==
expires: Sat, 03 Aug 2024 07:04:48 GMT

GET
H3 200 font-awesome-4.3.0.min.css
smhttp-nex.nexcesscdn.net/803313/static/vten/css/ 23 KB
6 KB 101ms
26ms Stylesheet
text/css 104.18.22.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://smhttp-nex.nexcesscdn.net/803313/static/vten/css/font-awesome-4.3.0.min.css
Requested by: Host: payment.cristalinolodge.com.br
URL: https://payment.cristalinolodge.com.br/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.22.80 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 44f70ac97abe0978504c99a5fb7ccd0718dc744948bda63ec140a08d58a18ea7

Request headers

Referer: https://payment.cristalinolodge.com.br/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 07:04:48 GMT
x-amz-version-id: Prxh2_jMQXdQtKrEf1uN7BaEBYxLuDr4
via: 1.1 88a1a7ad0454e586dd16517855f87aea.cloudfront.net (CloudFront)
x-edge-region: us-midwest-1
cf-cache-status: HIT
x-amz-cf-pop: ORD56-P6
age: 6823
content-encoding: br
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400
x-request-id: req-4512-1721785491.611-18.116.190.245-403-0-
last-modified: Fri, 17 Sep 2021 18:49:05 GMT
server: cloudflare
x-amz-meta-s3cmd-attrs: atime:1425664878/ctime:1438795497/gid:1005/gname:nexcessn/md5:7526aa3a498be2b727625ad08a6ef83a/mode:33188/mtime:1438795493/uid:1001/uname:nexcessn
etag: W/"7526aa3a498be2b727625ad08a6ef83a"
vary: Accept-Encoding
x-edge-server: eadn-wc04-dtw
content-type: text/css
access-control-allow-origin: *
x-edge: STALE
cache-control: public, max-age=172800
cf-ray: 8ac3f9e63e984d88-FRA
x-amz-cf-id: TfeY5ccGZjHzts9NOi6utzvoNqf2m2yUhpKy8ct8df4lQ7nGOnZOnw==
expires: Sat, 03 Aug 2024 07:04:48 GMT

GET
H3 200 nexcess.min-1439655468.css
smhttp-nex.nexcesscdn.net/803313/static/vten/css/ 76 KB
14 KB 107ms
32ms Stylesheet
text/css 104.18.22.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://smhttp-nex.nexcesscdn.net/803313/static/vten/css/nexcess.min-1439655468.css
Requested by: Host: payment.cristalinolodge.com.br
URL: https://payment.cristalinolodge.com.br/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.22.80 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 01cb3058791e26d0bbe9207ba58c5ccb741c43d91314e54ce2aa16bac3215009

Request headers

Referer: https://payment.cristalinolodge.com.br/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 07:04:48 GMT
x-amz-version-id: zsdmqBB72MyoqtzjtCWz.NAPjDvvtpmB
via: 1.1 02a2bd1a95c9e133cb6af71565738388.cloudfront.net (CloudFront)
x-edge-region: us-midwest-1
cf-cache-status: HIT
x-amz-cf-pop: CMH68-P4
age: 6823
content-encoding: br
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400
x-request-id: req-4512-1721785491.614-18.116.190.245-403-0-
last-modified: Fri, 17 Sep 2021 18:49:05 GMT
server: cloudflare
x-amz-meta-s3cmd-attrs: atime:1439667609/ctime:1442002926/gid:1005/gname:nexcessn/md5:1c8eb3eedfaf417441eb1faece05fcf9/mode:33188/mtime:1442002925/uid:1001/uname:nexcessn
etag: W/"1c8eb3eedfaf417441eb1faece05fcf9"
vary: Accept-Encoding
x-edge-server: eadn-wc04-dtw
content-type: text/css
access-control-allow-origin: *
x-edge: STALE
cache-control: public, max-age=172800
cf-ray: 8ac3f9e63e974d88-FRA
x-amz-cf-id: F6KLNHxhg3tgVu8geHTYgEnwWACRvgK9SUJJPBjU8JoeinoD5Yywew==
expires: Sat, 03 Aug 2024 07:04:48 GMT

GET
H2 200 widgets.js Show response
platform.twitter.com/ 91 KB
27 KB 47ms
7ms Script
application/javascript 146.75.120.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: payment.cristalinolodge.com.br
URL: https://payment.cristalinolodge.com.br/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 146.75.120.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 173460e89e6a7244218badae2016f65c48a3eae9d400802273eeca18b07336f1

Request headers

Referer: https://payment.cristalinolodge.com.br/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 07:04:48 GMT
content-encoding: gzip
x-amz-server-side-encryption: AES256
x-cache: HIT, HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-length: 27597
x-served-by: cache-iad-kjyo7100044-IAD, cache-fra-etou8220155-FRA
last-modified: Mon, 11 Dec 2023 17:20:28 GMT
etag: "824beb891744db98ccbd3a456e59e0f7+gzip"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=1800
accept-ranges: bytes
tw-cdn: FT

GET
H3 200 bg.png
smhttp-nex.nexcesscdn.net/803313/static/vten/style/ 49 KB
49 KB 29ms
29ms Image
image/png 104.18.22.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://smhttp-nex.nexcesscdn.net/803313/static/vten/style/bg.png
Requested by: Host: smhttp-nex.nexcesscdn.net
URL: https://smhttp-nex.nexcesscdn.net/803313/static/vten/css/nexcess.min-1439655468.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.22.80 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 96c5405729d2884480c76799cfcf231f1edb426fbcf66c58a25e43559a4a0ae9

Request headers

Referer: https://smhttp-nex.nexcesscdn.net/803313/static/vten/css/nexcess.min-1439655468.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 07:04:48 GMT
via: 1.1 3553261692b84388f31d013fa1d022f0.cloudfront.net (CloudFront)
x-amz-version-id: ZsNQm0MNiPfshooEK6uZa9RhwAuwKpLL
x-edge-region: us-midwest-1
cf-cache-status: HIT
x-amz-cf-pop: CMH68-P4
age: 6823
cf-polished: origSize=49928
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 49880
x-request-id: req-17370-1710174081.017-35.187.35.120-492-0-
cf-bgj: imgq:100,h2pri
last-modified: Fri, 17 Sep 2021 18:50:30 GMT
x-amz-meta-s3cmd-attrs: atime:1402493967/ctime:1402494015/gid:1005/gname:nexcessn/md5:719815e9182d29c613905dabd8c2d90e/mode:33204/mtime:1395425144/uid:1001/uname:nexcessn
server: cloudflare
etag: "719815e9182d29c613905dabd8c2d90e"
x-edge-server: eadn-wc02-dtw
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
x-edge: STALE
cache-control: public, max-age=172800
accept-ranges: bytes
cf-ray: 8ac3f9e69f0c4d88-FRA
x-amz-cf-id: t4Hrq7mlyTO_CLjK6tHpkOfike4qaGx7EuFz4drjeIrHihO9xIqaeA==
expires: Sat, 03 Aug 2024 07:04:48 GMT

GET
H3 200 Nexcess_logo_tm.png
smhttp-nex.nexcesscdn.net/803313/static/vten/brand/ 3 KB
4 KB 36ms
35ms Image
image/png 104.18.22.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://smhttp-nex.nexcesscdn.net/803313/static/vten/brand/Nexcess_logo_tm.png
Requested by: Host: smhttp-nex.nexcesscdn.net
URL: https://smhttp-nex.nexcesscdn.net/803313/static/vten/css/nexcess.min-1439655468.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.22.80 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 94061d6b1419d41e1ffcb3ee66de955b4ad34f4b025167802c6d54a0d931a077

Request headers

Referer: https://smhttp-nex.nexcesscdn.net/803313/static/vten/css/nexcess.min-1439655468.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 07:04:48 GMT
via: 1.1 c5445f293f8aab8bb6b7a6fda978e0d2.cloudfront.net (CloudFront)
x-amz-version-id: .nbI2gXXHZtxu4tKJzHpHq0bfndpD2a1
x-edge-region: us-midwest-1
cf-cache-status: HIT
x-amz-cf-pop: ORD56-P6
age: 6823
cf-polished: origSize=6506
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 3427
x-request-id: req-20635-1710186493.414-3.87.235.117-474-0-
cf-bgj: imgq:100,h2pri
last-modified: Fri, 17 Sep 2021 18:48:41 GMT
x-amz-meta-s3cmd-attrs: atime:1572876964/ctime:1572876965/gid:1005/gname:nexcessn/md5:37d5b534a72958adfa06b44d76ead275/mode:33204/mtime:1572358256/uid:1001/uname:nexcessn
server: cloudflare
etag: "37d5b534a72958adfa06b44d76ead275"
x-edge-server: eadn-wc01-dtw
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
x-edge: STALE
cache-control: public, max-age=172800
accept-ranges: bytes
cf-ray: 8ac3f9e69f0e4d88-FRA
x-amz-cf-id: 4ya85P29F0R5Wzgzgk80Lhog7ZZjCJQjYuw8i1VqZmAZUT1FSMlEHQ==
expires: Sat, 03 Aug 2024 07:04:48 GMT

GET
H3 200 fontawesome-webfont.woff2
smhttp-nex.nexcesscdn.net/803313/static/vten/font/ 63 KB
64 KB 232ms
211ms Font
binary/octet-stream 104.18.22.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://smhttp-nex.nexcesscdn.net/803313/static/vten/font/fontawesome-webfont.woff2?v=4.3.0
Requested by: Host: smhttp-nex.nexcesscdn.net
URL: https://smhttp-nex.nexcesscdn.net/803313/static/vten/css/font-awesome-4.3.0.min.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.22.80 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3c4a1bb7ce3234407184f0d80cc4dec075e4ad616b44dcc5778e1cfb1bc24019

Request headers

Referer: https://smhttp-nex.nexcesscdn.net/803313/static/vten/css/font-awesome-4.3.0.min.css
Origin: https://payment.cristalinolodge.com.br
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 07:04:48 GMT
x-amz-version-id: BhD1Dfk6UDosWaodIAnOJJ2gbojDxu0K
via: 1.1 592c261b9cfaf6b108698873e1d16e28.cloudfront.net (CloudFront)
x-edge-region: us-midwest-1
cf-cache-status: MISS
x-amz-cf-pop: ORD56-P6
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 64464
x-request-id: req-17044-1722495888.522-78.159.108.28-480-0-
last-modified: Fri, 17 Sep 2021 18:50:06 GMT
server: cloudflare
x-amz-meta-s3cmd-attrs: atime:1424719593/ctime:1443621365/gid:1005/gname:nexcessn/md5:4b5a84aaf1c9485e060c503a0ff8cadb/mode:33204/mtime:1441138234/uid:1001/uname:nexcessn
etag: "4b5a84aaf1c9485e060c503a0ff8cadb"
x-edge-server: eadn-wc01-dtw
vary: Accept-Encoding
content-type: binary/octet-stream
access-control-allow-origin: *
x-edge: HIT
cache-control: public, max-age=172800
accept-ranges: bytes
cf-ray: 8ac3f9e6aae89bcb-FRA
x-amz-cf-id: CE0szfqkgRWPCTQWRR7D5mt5W8CMzdwntSimt7kl98H1u8Wd62jdzg==
expires: Sat, 03 Aug 2024 07:04:48 GMT

GET
H/1.1 200
OK widget_iframe.2f70fb173b9000da126c79afe2098f02.html
platform.twitter.com/widgets/ Frame 7685 0
0 25ms
8ms Document
text/html 93.184.220.66
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fpayment.cristalinolodge.com.br
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 93.184.220.66 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/6711) /
Resource Hash

Request headers

Referer: https://payment.cristalinolodge.com.br/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 11152235
Cache-Control: public, max-age=315360000
Content-Encoding: gzip
Content-Length: 105429
Content-Type: text/html; charset=utf-8
Date: Thu, 01 Aug 2024 07:04:48 GMT
Etag: "81267302efdfb3e4524a22631a8fc99e+gzip"
Last-Modified: Mon, 11 Dec 2023 17:19:49 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (frb/6711)
Server-Timing: x-cache;desc= HIT,x-tw-cdn;desc=VZ
Vary: Accept-Encoding
X-Cache: HIT
x-amz-server-side-encryption: AES256
x-tw-cdn: VZ

GET
H/1.1 404
Not Found favicon.ico
payment.cristalinolodge.com.br/ 209 B
409 B 115ms
115ms Other
text/html 192.240.179.83
NEXCESS-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://payment.cristalinolodge.com.br/favicon.ico
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 192.240.179.83 , United States, ASN36444 (NEXCESS-NET, US),
Reverse DNS: eep2-06.nexcess.net
Software: Apache /
Resource Hash: b6682cab65d3243b5b75efb7279dbf49491957484780f2ba0a87632cc0e25642

Request headers

Referer: https://payment.cristalinolodge.com.br/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date: Thu, 01 Aug 2024 07:04:48 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 209
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 button.856debeac157d9669cf51e73a08fbc93.js Show response
platform.twitter.com/js/ 8 KB
3 KB 7ms
7ms Script
application/javascript 146.75.120.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/button.856debeac157d9669cf51e73a08fbc93.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 146.75.120.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 426e16d014775c77916610f675f58880874c645817ed26d01873dde3466e6007

Request headers

Referer: https://payment.cristalinolodge.com.br/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 07:04:48 GMT
content-encoding: gzip
x-amz-server-side-encryption: AES256
x-cache: HIT, HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-length: 2620
x-served-by: cache-iad-kjyo7100074-IAD, cache-fra-etou8220155-FRA
last-modified: Mon, 11 Dec 2023 17:19:47 GMT
etag: "fdf02dd038ed38dbf3c240d56262af0c+gzip"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
accept-ranges: bytes
tw-cdn: FT

GET
H/1.1 200
OK tweet_button.2f70fb173b9000da126c79afe2098f02.en.html
platform.twitter.com/widgets/ Frame 458F 0
0 11ms
11ms Document
text/html 93.184.220.66
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/tweet_button.2f70fb173b9000da126c79afe2098f02.en.html
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 93.184.220.66 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/674D) /
Resource Hash

Request headers

Referer: https://payment.cristalinolodge.com.br/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 11163519
Cache-Control: public, max-age=315360000
Content-Encoding: gzip
Content-Length: 12332
Content-Type: text/html; charset=utf-8
Date: Thu, 01 Aug 2024 07:04:48 GMT
Etag: "e29e65db7bf0a096587728e1faacfd9c+gzip"
Last-Modified: Mon, 11 Dec 2023 17:19:48 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (frb/674D)
Server-Timing: x-cache;desc= HIT,x-tw-cdn;desc=VZ
Vary: Accept-Encoding
X-Cache: HIT
x-amz-server-side-encryption: AES256
x-tw-cdn: VZ

GET
H2 200 embeds
syndication.twitter.com/i/jot/ 43 B
293 B 155ms
141ms Image
image/gif 104.244.42.200
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://syndication.twitter.com/i/jot/embeds?l=%7B%22widget_origin%22%3A%22https%3A%2F%2Fpayment.cristalinolodge.com.br%2F%22%2C%22widget_frame%22%3Afalse%2C%22language%22%3A%22en%22%2C%22message%22%3A%22m%3Anocount%3A%22%2C%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1722495888695%2C%22dnt%22%3Afalse%2C%22client_version%22%3A%222615f7e52b7e0%3A1702314776716%22%2C%22format_version%22%3A1%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22button%22%2C%22section%22%3A%22share%22%2C%22action%22%3A%22impression%22%7D%7D&session_id=1a114a82558c044a765edb60d2970c8ad2f8f7c7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.200 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

Referer: https://payment.cristalinolodge.com.br/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-response-time: 116
date: Thu, 01 Aug 2024 07:04:48 GMT
strict-transport-security: max-age=631138519
last-modified: Thu, 01 Aug 2024 07:04:48 GMT
server: tsa_o
vary: Origin
content-type: image/gif
x-transaction-id: b9e61c471326048a
cache-control: must-revalidate, max-age=600
perf: 7402827104
x-connection-hash: 740587a039c14480103e4ca8f4957b8032bc419afb40f218cd666335fe84f753
content-length: 43

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://payment.cristalinolodge.com.br/favicon.ico Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

payment.cristalinolodge.com.br
platform.twitter.com
smhttp-nex.nexcesscdn.net
syndication.twitter.com
104.18.22.80
104.244.42.200
146.75.120.157
192.240.179.83
93.184.220.66
01cb3058791e26d0bbe9207ba58c5ccb741c43d91314e54ce2aa16bac3215009
173460e89e6a7244218badae2016f65c48a3eae9d400802273eeca18b07336f1
3c4a1bb7ce3234407184f0d80cc4dec075e4ad616b44dcc5778e1cfb1bc24019
426e16d014775c77916610f675f58880874c645817ed26d01873dde3466e6007
44f70ac97abe0978504c99a5fb7ccd0718dc744948bda63ec140a08d58a18ea7
9019994903b6d05b2e75d7a4e13a150a79ffcde2ec0ea9f0f8cf78d687026d59
94061d6b1419d41e1ffcb3ee66de955b4ad34f4b025167802c6d54a0d931a077
96c5405729d2884480c76799cfcf231f1edb426fbcf66c58a25e43559a4a0ae9
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
b6682cab65d3243b5b75efb7279dbf49491957484780f2ba0a87632cc0e25642
d31bef450ee67b64f9b70bfdf41fe4e00c65438705cc1fbb48ea6026d3a5d697

payment.cristalinolodge.com.br Open in urlscan Pro 192.240.179.83 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

0 %IPv6

3 Domains

4 Subdomains

5 IPs

4 Countries

194 kBTransfer

434 kBSize

0 Cookies

20 Outgoing links

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

payment.cristalinolodge.com.br Open in urlscan Pro
192.240.179.83 Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

5
IPs

4
Countries

194 kB
Transfer

434 kB
Size

0
Cookies

13 HTTP transactions
0 data transactions