offerlia.com
Open in
urlscan Pro
103.104.122.68
Malicious Activity!
Public Scan
Effective URL: https://offerlia.com/sweeps_6/index_16.php?device_name=Desktop&browser_name=Chrome&language=en-US&city=West%20Chicago...
Submission: On April 12 via api from BE — Scanned from US
Summary
TLS certificate: Issued by R3 on April 5th 2023. Valid for: 3 months.
This is the only time offerlia.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Scam (Online) Customer Survey Spam (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 52.218.196.153 52.218.196.153 | 16509 (AMAZON-02) (AMAZON-02) | |
1 1 | 185.235.218.32 185.235.218.32 | 202302 (NETH-AS) (NETH-AS) | |
1 1 | 104.199.34.244 104.199.34.244 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
1 1 | 2606:4700:303... 2606:4700:3031::6815:3688 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
21 | 103.104.122.68 103.104.122.68 | 135932 (VNDATA-AS...) (VNDATA-AS-VN Viet Storage Technology Joint Stock Company) | |
2 | 2600:9000:220... 2600:9000:2209:f600:b:4623:cac0:21 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2607:f8b0:400... 2607:f8b0:400c:c15::5f | 15169 (GOOGLE) (GOOGLE) | |
25 | 4 |
ASN16509 (AMAZON-02, US)
PTR: s3-us-west-2-r-w.amazonaws.com
sgegrhtr.s3.us-west-2.amazonaws.com |
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 244.34.199.104.bc.googleusercontent.com
boapoar.com |
ASN135932 (VNDATA-AS-VN Viet Storage Technology Joint Stock Company, VN)
PTR: static-ptr.vndata.vn
offerlia.com |
ASN16509 (AMAZON-02, US)
d3e1y4kxkqljcb.cloudfront.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
21 |
offerlia.com
offerlia.com |
487 KB |
2 |
cloudfront.net
d3e1y4kxkqljcb.cloudfront.net |
91 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 47 |
1 KB |
1 |
bsttpl.com
1 redirects
bsttpl.com — Cisco Umbrella Rank: 464221 |
1 KB |
1 |
boapoar.com
1 redirects
boapoar.com |
748 B |
1 |
haawwi.online
1 redirects
haawwi.online |
369 B |
1 |
amazonaws.com
sgegrhtr.s3.us-west-2.amazonaws.com |
654 B |
25 | 7 |
Domain | Requested by | |
---|---|---|
21 | offerlia.com |
sgegrhtr.s3.us-west-2.amazonaws.com
offerlia.com |
2 | d3e1y4kxkqljcb.cloudfront.net |
offerlia.com
|
1 | fonts.googleapis.com |
offerlia.com
|
1 | bsttpl.com | 1 redirects |
1 | boapoar.com | 1 redirects |
1 | haawwi.online | 1 redirects |
1 | sgegrhtr.s3.us-west-2.amazonaws.com | |
25 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.s3-us-west-2.amazonaws.com Amazon |
2022-09-21 - 2023-08-24 |
a year | crt.sh |
offerlia.com R3 |
2023-04-05 - 2023-07-04 |
3 months | crt.sh |
*.cloudfront.net Amazon RSA 2048 M01 |
2022-12-08 - 2023-12-07 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-03-28 - 2023-06-20 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://offerlia.com/sweeps_6/index_16.php?device_name=Desktop&browser_name=Chrome&language=en-US&city=West%20Chicago&clickid=bb5e4cisyxovcf9f&campaign=4193&user_id=1&clickcost=0&lander=1743&time=1681273622&browser_version=111.0.5563.146&device_model=Desktop&device_brand=Desktop&resolution=desktop&os_name=Windows&os_version=10.0&country=United%20States&country_code=US&isp=Nexeon%20Technologies,%20Inc.&ip=2602:ffc8:1:1::3&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/111.0.5563.146%20Safari/537.36&lpkey=164581c62971195322&target=Unknown&device=DESKTOP&country=US&ts=id2&trafficsource=2&uclick=cisyxovc&uclickhash=cisyxovc-cisyxovc-k29z-8pvr-u3d5-7svc6o-7svcdz-5841cf
Frame ID: FD3FD8262B6038040BF9BA216093FEE4
Requests: 25 HTTP requests in this frame
Screenshot
Page Title
[1] Reward Pending - We Want Your Opinion!Page URL History Show full URLs
- https://sgegrhtr.s3.us-west-2.amazonaws.com/cascw.html Page URL
-
http://haawwi.online/cl/7773_md/2222/354/1127/13/140620
HTTP 302
https://boapoar.com/?a=3553&oc=16934&c=46213&m=3&s1=2222&s2=7773_1&s3=13_140620_354_624886_md HTTP 302
https://bsttpl.com/click.php?key=v21zvzm1cyidg0gibykt&clickid=302560591&affid=3553&target=&ts=id2 HTTP 302
https://offerlia.com/sweeps_6/index_16.php?device_name=Desktop&browser_name=Chrome&language=en-US... Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Bootstrap (Web Frameworks) Expand
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://sgegrhtr.s3.us-west-2.amazonaws.com/cascw.html Page URL
-
http://haawwi.online/cl/7773_md/2222/354/1127/13/140620
HTTP 302
https://boapoar.com/?a=3553&oc=16934&c=46213&m=3&s1=2222&s2=7773_1&s3=13_140620_354_624886_md HTTP 302
https://bsttpl.com/click.php?key=v21zvzm1cyidg0gibykt&clickid=302560591&affid=3553&target=&ts=id2 HTTP 302
https://offerlia.com/sweeps_6/index_16.php?device_name=Desktop&browser_name=Chrome&language=en-US&city=West%20Chicago&clickid=bb5e4cisyxovcf9f&campaign=4193&user_id=1&clickcost=0&lander=1743&time=1681273622&browser_version=111.0.5563.146&device_model=Desktop&device_brand=Desktop&resolution=desktop&os_name=Windows&os_version=10.0&country=United%20States&country_code=US&isp=Nexeon%20Technologies,%20Inc.&ip=2602:ffc8:1:1::3&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/111.0.5563.146%20Safari/537.36&lpkey=164581c62971195322&target=Unknown&device=DESKTOP&country=US&ts=id2&trafficsource=2&uclick=cisyxovc&uclickhash=cisyxovc-cisyxovc-k29z-8pvr-u3d5-7svc6o-7svcdz-5841cf Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
25 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
cascw.html
sgegrhtr.s3.us-west-2.amazonaws.com/ |
260 B 654 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
index_16.php
offerlia.com/sweeps_6/ Redirect Chain
|
62 KB 15 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
offerlia.com/sweeps_6/assets/ |
157 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.css
offerlia.com/sweeps_6/assets/ |
72 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
common.css
offerlia.com/sweeps_6/assets/ |
34 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
walmart_logo_new.png
offerlia.com/sweeps_6/assets/ |
11 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
02831ab02f02782d9c47fffcfd5eadc4.png
offerlia.com/sweeps_6/assets/ |
18 KB 18 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
samsungtv_withoutbg.png
d3e1y4kxkqljcb.cloudfront.net/survey_us_d/withoutbg/ |
81 KB 81 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tv_comment1.jpg
offerlia.com/sweeps_6/assets/ |
55 KB 55 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tv_comment2.jpg
offerlia.com/sweeps_6/assets/ |
33 KB 34 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tv_comment3.jpg
offerlia.com/sweeps_6/assets/ |
70 KB 70 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
f52dd02fdbe33cb89087dd83d16dc230.png
offerlia.com/sweeps_6/assets/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
d34bd763d46c8f2ddf09fc415fbc3c06.png
offerlia.com/sweeps_6/assets/ |
10 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
279132e34471a44f9e9c889082127894.png
offerlia.com/sweeps_6/assets/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.4.1.min.js
offerlia.com/sweeps_6/assets/ |
86 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
offerlia.com/sweeps_6/assets/ |
62 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
myscript.js
offerlia.com/sweeps_6/assets/ |
3 KB 1022 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
redirect_bin.js
offerlia.com/ |
2 KB 865 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
common.js
offerlia.com/sweeps_6/assets/ |
49 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
5 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index_16.php
offerlia.com/sweeps_6/ |
62 KB 62 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fa-solid-900.woff2
offerlia.com/sweeps_6/assets/fonts/ |
93 KB 93 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
halloween_sweeps.css
offerlia.com/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
comm_sweeps.jpg
d3e1y4kxkqljcb.cloudfront.net/survey_us_d/ |
10 KB 10 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icomoonMain.ttf
offerlia.com/ |
2 KB 2 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Scam (Online) Customer Survey Spam (Consumer)57 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless function| $ function| jQuery object| bootstrap function| datehax function| startTimer string| redirect_url string| back_url_link string| attrChoices string| domain number| count string| pipeline string| zipcode string| state_selected boolean| processing object| states function| birthdayFill function| beforeShowQuestion function| showOfferWall function| createQuestion function| processQuestion function| nextQuestion function| replaceUrlParam function| popunder number| box_trying boolean| oneclick function| formatPhoneNumber function| switchTypeQuestions function| validatePhone function| validateEmail function| validateZip function| sendZipIp function| validateHeightF function| validateHeightI function| validateWeight function| validateAll function| validateName function| validateLName function| validateBirthday function| days function| daysInMonth function| dashedNumber function| alpha function| validateKeyStrokes function| showStreetState function| leadgenForm function| overflowP function| showDisclaimer function| preventS function| comment function| like function| createQuestionU function| nextQuestionU function| validateData function| showStreetStateU function| showModal function| showOfferWallU5 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.boapoar.com/ | Name: st Value: XnWYp3rmNNKbTrnUmm1PTUVwx0M3LqO1xxWEuYN+rzVIkSQ2ckINsQ== |
|
.boapoar.com/ | Name: tym Value: 9P4d+kLtDfE+Cf0nJR/ki0Vwx0M3LqO1xxWEuYN+rzVIkSQ2ckINsQ== |
|
.boapoar.com/ | Name: c16882 Value: XnWYp3rmNNLT6sX9oZRopXiVodUGTb5salAWw+ZAGTbm2Toa+R7IHg== |
|
bsttpl.com/ | Name: uclick Value: cisyxovc |
|
bsttpl.com/ | Name: uclickhash Value: cisyxovc-cisyxovc-k29z-8pvr-u3d5-7svc6o-7svcdz-5841cf |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
boapoar.com
bsttpl.com
d3e1y4kxkqljcb.cloudfront.net
fonts.googleapis.com
haawwi.online
offerlia.com
sgegrhtr.s3.us-west-2.amazonaws.com
103.104.122.68
104.199.34.244
185.235.218.32
2600:9000:2209:f600:b:4623:cac0:21
2606:4700:3031::6815:3688
2607:f8b0:400c:c15::5f
52.218.196.153
06d81345fc255d392fe9d296124a99392dafab5dde522058f9fd24e0d96b5dad
07796391ee269c0deec281aec669d7c1c866d831f6f76d50a66c67406bcade3e
09a4029c5513557f2abce67218e83db54179cc0d9370141bb2fbca0273d6a0d7
38ed4c56bd11eea0c7b76524d7995647f7075b95cb8a4068a473806658797286
4c24dfd28784ad2befb3dafaac6bf1ed4e7cd58cce713d9a0b228d426e812baf
63c85ead3158e9a9b26c501ec9b5addfb6a86103b87c290a09d544b815e963cb
8328bab88f30849150677f8e75d79ac10518e91082df483c07f2e85add94de12
85477bb341dc7872cd0a2321cd050a451a2c90e75117ce7c4bb33b7d981fb424
8ee7fbb44ddf5fa7e34f561acff6064d2d47749d492ebca5f538bbace76483f8
9ab4f4c2fbb7f22fd22e510a5797ecb47fb1c05c60c9c7ddc578d3841adaf33f
b53c3705820aa3ec5107b28abc34d376a57513bbce4fefa44e4868bc8b2de2c1
b6b4e26ebed88d05b445b099eb8e460cc0b6b97725af0f82f64e7be664891168
bc4ba5ab1f79419e5c8a06db6d5ed27f78b026617608d8513bdf476bf78e1120
bf97443d681d2bc0ca04b707d0d3d443bcf99b1bf4fc0af84ac51286d0b4e02b
c0109e9747e94335267d540104b0b256bc507882206be853bfbd6b13ddb1c277
c3e512711b33e96a612ebe17258686e941f9af183846399f39a17bbe12c78ae1
c6c896e27ff1f1d6cb22ce652dcca916946ce9f003bcb4fe30d1265fcb531a95
c889fb1af64cceab36a53b3d6e622710e0880b0ed4b38be7730561105b3c5bcc
d8968086f7509df34c3278563dab87399da4f9dcdfb419818e3a309eedc70b88
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e99003f5d746f15741333c91e9553fa75c9d9e56a501d26fe5fb5a303c5c56f9
f47006e231f44179218c630f18c68323a0a13fe4517103d83dc3147bae4b5709
f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194
fa98de86ae59f2190f218ec8e35c42bc3767e71c05aa2000392082d9e2dfa2f0