root.greenlightroot.xyz
Open in
urlscan Pro
198.23.209.139
Public Scan
Effective URL: https://root.greenlightroot.xyz/0u0gb2pf3lnltx8rksrykp1c.php?C28H3G1604075130dd23ba8fd2a1e2b00b6b490e16676f0add23ba8fd2a1e2b00b6...
Submission Tags: falconsandbox
Submission: On October 30 via api from US
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on October 14th 2020. Valid for: 3 months.
This is the only time root.greenlightroot.xyz was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 167.89.115.121 167.89.115.121 | 11377 (SENDGRID) (SENDGRID) | |
1 | 192.3.41.18 192.3.41.18 | 36352 (AS-COLOCR...) (AS-COLOCROSSING) | |
1 5 | 198.23.209.139 198.23.209.139 | 36352 (AS-COLOCR...) (AS-COLOCROSSING) | |
1 | 2001:4de0:ac1... 2001:4de0:ac19::1:b:1b | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
3 | 2a00:1450:400... 2a00:1450:4001:821::2004 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:814::2003 | 15169 (GOOGLE) (GOOGLE) | |
10 | 5 |
ASN11377 (SENDGRID, US)
PTR: o16789115x121.outbound-mail.sendgrid.net
u14279491.ct.sendgrid.net |
ASN36352 (AS-COLOCROSSING, US)
PTR: 192-3-41-18-host.colocrossing.com
root.basefireshooting.xyz |
ASN36352 (AS-COLOCROSSING, US)
PTR: 198-23-209-139-host.colocrossing.com
root.greenlightroot.xyz |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
greenlightroot.xyz
1 redirects
root.greenlightroot.xyz |
2 KB |
3 |
google.com
www.google.com |
642 B |
1 |
gstatic.com
www.gstatic.com |
134 KB |
1 |
bootstrapcdn.com
stackpath.bootstrapcdn.com |
23 KB |
1 |
basefireshooting.xyz
root.basefireshooting.xyz |
374 B |
1 |
sendgrid.net
1 redirects
u14279491.ct.sendgrid.net |
263 B |
10 | 6 |
Domain | Requested by | |
---|---|---|
5 | root.greenlightroot.xyz |
1 redirects
root.basefireshooting.xyz
root.greenlightroot.xyz |
3 | www.google.com |
root.greenlightroot.xyz
www.gstatic.com |
1 | www.gstatic.com |
www.google.com
|
1 | stackpath.bootstrapcdn.com |
root.greenlightroot.xyz
|
1 | root.basefireshooting.xyz | |
1 | u14279491.ct.sendgrid.net | 1 redirects |
10 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
root.basefireshooting.xyz Let's Encrypt Authority X3 |
2020-10-20 - 2021-01-18 |
3 months | crt.sh |
root.greenlightroot.xyz Let's Encrypt Authority X3 |
2020-10-14 - 2021-01-12 |
3 months | crt.sh |
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA |
2020-09-22 - 2021-10-12 |
a year | crt.sh |
www.google.com GTS CA 1O1 |
2020-10-06 - 2020-12-29 |
3 months | crt.sh |
*.gstatic.com GTS CA 1O1 |
2020-10-06 - 2020-12-29 |
3 months | crt.sh |
*.google.com GTS CA 1O1 |
2020-10-06 - 2020-12-29 |
3 months | crt.sh |
This page contains 3 frames:
Primary Page:
https://root.greenlightroot.xyz/0u0gb2pf3lnltx8rksrykp1c.php?C28H3G1604075130dd23ba8fd2a1e2b00b6b490e16676f0add23ba8fd2a1e2b00b6b490e16676f0add23ba8fd2a1e2b00b6b490e16676f0add23ba8fd2a1e2b00b6b490e16676f0add23ba8fd2a1e2b00b6b490e16676f0a&emc=Y29udGFjdHVzQGxpdmluLmNvLnVr
Frame ID: 89F46544EE2044BBC9EF48C861D429F5
Requests: 8 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lc-e-0UAAAAAGI6WmvqM0NpIKpAbop_PEu0WNw3&co=aHR0cHM6Ly9yb290LmdyZWVubGlnaHRyb290Lnh5ejo0NDM.&hl=en&v=4lbq4vBYAu25DMtzZ7GGbfAF&size=normal&cb=983k0uq3q0sg
Frame ID: C89BDCDB64300A0943AB87AD5D058308
Requests: 1 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/bframe?hl=en&v=4lbq4vBYAu25DMtzZ7GGbfAF&k=6Lc-e-0UAAAAAGI6WmvqM0NpIKpAbop_PEu0WNw3&cb=kcb79kh4f6qz
Frame ID: C374D46E9BCFF6543F0D6DE524CCF40D
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://u14279491.ct.sendgrid.net/ls/click?upn=Vpk8rrxTTXxoqQm1U6OS2YazOOWWMYMo7bN9-2F-2BBLr7oKXIXyEiHJQaAgioy...
HTTP 302
https://root.basefireshooting.xyz/sasa/contactus@livin.co.uk Page URL
- https://root.greenlightroot.xyz/4c2c16-rand-90719/907194c2c1627?target=Y29udGFjdHVzQGxpdmluLmNvLnVr Page URL
- https://root.greenlightroot.xyz/4c2c16-rand-90719/.,/phil.php?email=Y29udGFjdHVzQGxpdmluLmNvLnVr Page URL
- https://root.greenlightroot.xyz/4c2c16-rand-90719/phil.php?email=Y29udGFjdHVzQGxpdmluLmNvLnVr Page URL
-
https://root.greenlightroot.xyz/phil.php?email=Y29udGFjdHVzQGxpdmluLmNvLnVr
HTTP 302
https://root.greenlightroot.xyz/0u0gb2pf3lnltx8rksrykp1c.php?C28H3G1604075130dd23ba8fd2a1e2b00b6b490e16676f0... Page URL
Detected technologies
Nginx (Web Servers) ExpandDetected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://u14279491.ct.sendgrid.net/ls/click?upn=Vpk8rrxTTXxoqQm1U6OS2YazOOWWMYMo7bN9-2F-2BBLr7oKXIXyEiHJQaAgioyoFEzx9fCbrDdgsg1d-2BhFVItlRpfp-2BaRTSPdfpwNDQdIdn8es-3DXERu_LRmZwZTIHdvEbXw2vhgkxtgURoj1p5AiPCeKHcldwBLa4O7Ehtaq1nBlwTw49FpWq84gqMdmB-2F-2BIXKpQ3EAkI-2BYa-2FOJM-2Bv2Tlp9jIk7oaxT2c-2FIDOSColfMpVJWKnoozrfXJAeOw73jnbmgHMDMWUZo5Q2v-2FuO0Hwe07QLLSR-2BkxuYx6gIVirXMgW8zf47pcXnJRW0I6wWwE05Y9F6OoK-2B77aTO8-2FzB1YRdLr49-2B-2BNs-3D
HTTP 302
https://root.basefireshooting.xyz/sasa/contactus@livin.co.uk Page URL
- https://root.greenlightroot.xyz/4c2c16-rand-90719/907194c2c1627?target=Y29udGFjdHVzQGxpdmluLmNvLnVr Page URL
- https://root.greenlightroot.xyz/4c2c16-rand-90719/.,/phil.php?email=Y29udGFjdHVzQGxpdmluLmNvLnVr Page URL
- https://root.greenlightroot.xyz/4c2c16-rand-90719/phil.php?email=Y29udGFjdHVzQGxpdmluLmNvLnVr Page URL
-
https://root.greenlightroot.xyz/phil.php?email=Y29udGFjdHVzQGxpdmluLmNvLnVr
HTTP 302
https://root.greenlightroot.xyz/0u0gb2pf3lnltx8rksrykp1c.php?C28H3G1604075130dd23ba8fd2a1e2b00b6b490e16676f0add23ba8fd2a1e2b00b6b490e16676f0add23ba8fd2a1e2b00b6b490e16676f0add23ba8fd2a1e2b00b6b490e16676f0add23ba8fd2a1e2b00b6b490e16676f0a&emc=Y29udGFjdHVzQGxpdmluLmNvLnVr Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://u14279491.ct.sendgrid.net/ls/click?upn=Vpk8rrxTTXxoqQm1U6OS2YazOOWWMYMo7bN9-2F-2BBLr7oKXIXyEiHJQaAgioyoFEzx9fCbrDdgsg1d-2BhFVItlRpfp-2BaRTSPdfpwNDQdIdn8es-3DXERu_LRmZwZTIHdvEbXw2vhgkxtgURoj1p5AiPCeKHcldwBLa4O7Ehtaq1nBlwTw49FpWq84gqMdmB-2F-2BIXKpQ3EAkI-2BYa-2FOJM-2Bv2Tlp9jIk7oaxT2c-2FIDOSColfMpVJWKnoozrfXJAeOw73jnbmgHMDMWUZo5Q2v-2FuO0Hwe07QLLSR-2BkxuYx6gIVirXMgW8zf47pcXnJRW0I6wWwE05Y9F6OoK-2B77aTO8-2FzB1YRdLr49-2B-2BNs-3D HTTP 302
- https://root.basefireshooting.xyz/sasa/contactus@livin.co.uk
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
contactus@livin.co.uk
root.basefireshooting.xyz/sasa/ Redirect Chain
|
165 B 374 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
907194c2c1627
root.greenlightroot.xyz/4c2c16-rand-90719/ |
112 B 318 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
phil.php
root.greenlightroot.xyz/4c2c16-rand-90719/.,/ |
112 B 318 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
phil.php
root.greenlightroot.xyz/4c2c16-rand-90719/ |
112 B 318 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
Cookie set
0u0gb2pf3lnltx8rksrykp1c.php
root.greenlightroot.xyz/ Redirect Chain
|
1 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/ |
152 KB 23 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
api.js
www.google.com/recaptcha/ |
850 B 642 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
recaptcha__en.js
www.gstatic.com/recaptcha/releases/4lbq4vBYAu25DMtzZ7GGbfAF/ |
343 KB 134 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
anchor
www.google.com/recaptcha/api2/ Frame C89B |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
bframe
www.google.com/recaptcha/api2/ Frame C374 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| 2 function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client function| recaptchaCallback object| recaptcha object| closure_lm_6273881 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
root.greenlightroot.xyz/ | Name: PHPSESSID Value: g7hpj670g66cm5c744tp7vokin |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
root.basefireshooting.xyz
root.greenlightroot.xyz
stackpath.bootstrapcdn.com
u14279491.ct.sendgrid.net
www.google.com
www.gstatic.com
167.89.115.121
192.3.41.18
198.23.209.139
2001:4de0:ac19::1:b:1b
2a00:1450:4001:814::2003
2a00:1450:4001:821::2004
03612b7519ea329a52104c012afee0efad034dfc96a4386820deab9e8cca3fef
04110f3830eefb4c6352690a0f037577935b000b0ffacc54984521e02dc86ed5
4299615e09721974b07605401aa03525500c589796a68735949a1fc2fb36ed51
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36
84aff23bb47fbea74e9c9944cc840a4c17dbf1c32fc9f6a5c4717417e02751c6
ba94eaf90519494de4ee847524ee2d3567f8518dbd66dcb0a5f610cee321976d
cdd4293896bc33541b6c2fa1314bc9084a29d82c2a3e89ba884e033373cccade