![](/screenshots/69deaf6a-c5e2-4cd9-938e-6b9190dfb9fd.png)
gateway.restoringcord.xyz
Open in
urlscan Pro
172.67.205.183
Public Scan
Submission Tags: @phish_report
Submission: On July 19 via api from FI — Scanned from FI
Summary
TLS certificate: Issued by WE1 on July 16th 2024. Valid for: 3 months.
This is the only time gateway.restoringcord.xyz was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 172.67.205.183 172.67.205.183 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 172.66.40.207 172.66.40.207 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2a00:1450:400... 2a00:1450:4001:80b::2003 | 15169 (GOOGLE) (GOOGLE) | |
5 | 4 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
gstatic.com
fonts.gstatic.com |
75 KB |
1 |
restorecord.com
restorecord.com Failed cdn.restorecord.com |
10 KB |
1 |
restoringcord.xyz
gateway.restoringcord.xyz |
5 KB |
5 | 3 |
Domain | Requested by | |
---|---|---|
2 | fonts.gstatic.com |
gateway.restoringcord.xyz
|
1 | cdn.restorecord.com |
gateway.restoringcord.xyz
|
1 | gateway.restoringcord.xyz | |
0 | restorecord.com Failed |
gateway.restoringcord.xyz
|
5 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
auth.restoringcord.xyz |
Subject Issuer | Validity | Valid | |
---|---|---|---|
restoringcord.xyz WE1 |
2024-07-16 - 2024-10-14 |
3 months | crt.sh |
restorecord.com WE1 |
2024-06-21 - 2024-09-19 |
3 months | crt.sh |
*.gstatic.com WR2 |
2024-06-24 - 2024-09-16 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://gateway.restoringcord.xyz/verification?data=eyJndWlsZElkIjogOTY3NTQ2ODgyMzI5MDM0ODAyLCAiY2xpZW50SWQiOiAxMjYzNDk5ODkzMzk0MjQ3Nzk0LCAibmFtZSI6ICJOVURFUyAmIExFQUtTIFx1ZDgzZFx1ZGQxZSB8IEUtR0lSTCBcdTIwMjIgTklUUk8gXHVkODNjXHVkZjUxIiwgImV4cGlyZXMiOiAiMTcyMTQxMzA4NyIsICJkb21haW4iOiAiYXV0aC5yZXN0b3Jpbmdjb3JkLnh5eiJ9
Frame ID: 119AF8DC9CD66F2C2D09A2AC700CD32F
Requests: 5 HTTP requests in this frame
1 Outgoing links
These are links going to different origins than the main page.
Title: Verify
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
5 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
verification
gateway.restoringcord.xyz/ |
48 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
907a4567ba2948de.css
restorecord.com/_next/static/css/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo512.png
cdn.restorecord.com/ |
9 KB 10 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7W0Q5nw.woff2
fonts.gstatic.com/s/inter/v13/ |
45 KB 46 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
UcCO3FwrK3iLTeHuS_fvQtMwCp50KnMw2boKoduKmMEVuFuYAZ9hjg.woff
fonts.gstatic.com/s/inter/v13/ |
29 KB 29 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- restorecord.com
- URL
- https://restorecord.com/_next/static/css/907a4567ba2948de.css
Verdicts & Comments Add Verdict or Comment
8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| _0x4074c1 function| getParameterByName string| dataParam function| _0x29a9 function| _0x1586 string| decodedData object| jsonData object| verificationButton0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.restorecord.com
fonts.gstatic.com
gateway.restoringcord.xyz
restorecord.com
restorecord.com
172.66.40.207
172.67.205.183
2a00:1450:4001:80b::2003
3bcf04ca301e44f13f404c8a04aa4ae707f67a950e12ef30c238f96e784266a1
8c376c5f1480b3f80fad49fcf7a96314d9b71aa91eb6f193d636d1ac57d47e3d
adc6e86d7fff513934f5eef8d9a49c6b83ccfe4b9dc571b6076106ab9f688df1
d1a0a32e8d49017912d40af0d18cc4cd423b9da133d9dc6d78ace46f5aaa1c82