urlscan.io logo urlscan.io
SecurityTrails logo

shorturl.today Open in urlscan Pro
185.162.227.217  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://goimaginate.com/ao.php
Effective URL: https://shorturl.today/wp-content/themes/sketch/r/rack2/index.php
Submission Tags: falconsandbox
Submission: On October 22 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 7 IPs in 4 countries across 9 domains to perform 11 HTTP transactions. The main IP is 185.162.227.217, located in United Kingdom and belongs to UKFAST, GB. The main domain is shorturl.today.
TLS certificate: Issued by cPanel, Inc. Certification Authority on September 12th 2021. Valid for: 3 months.
This is the only time shorturl.today was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Rackspace (Online)

Domain & IP information

IP Address AS Autonomous System
1 185.67.0.230 50673 (SERVERIUS-AS)
2 185.162.227.217 61323 (UKFAST)
1 142.250.186.42 15169 (GOOGLE)
1 13.210.234.248 16509 (AMAZON-02)
3 104.130.182.72 27357 (RACKSPACE)
2 142.250.185.226 15169 (GOOGLE)
1 1 216.58.212.162 15169 (GOOGLE)
1 1 142.250.185.132 15169 (GOOGLE)
1 142.250.186.35 15169 (GOOGLE)
11 7
1    185.67.0.230 (Netherlands)

ASN50673 (SERVERIUS-AS, NL)
PTR: childstick.com
goimaginate.com
2    185.162.227.217 (United Kingdom)

ASN61323 (UKFAST, GB)
PTR: server217.geeconglobal.com
shorturl.today
1    142.250.186.42 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f10.1e100.net
ajax.googleapis.com
1    13.210.234.248 (Sydney, Australia)

ASN16509 (AMAZON-02, US)
PTR: ec2-13-210-234-248.ap-southeast-2.compute.amazonaws.com
www.linq.it
3    104.130.182.72 (San Antonio, United States)

ASN27357 (RACKSPACE, US)
cp.rackspace.com
2    142.250.185.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f2.1e100.net
www.googleadservices.com
1    216.58.212.162 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: ams15s22-in-f162.1e100.net
googleads.g.doubleclick.net
1    142.250.185.132 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f4.1e100.net
www.google.com
1    142.250.186.35 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f3.1e100.net
www.google.de
Domain Requested by
3 cp.rackspace.com shorturl.today
2 www.googleadservices.com shorturl.today
www.googleadservices.com
2 shorturl.today shorturl.today
1 www.google.de shorturl.today
1 www.google.com 1 redirects
1 googleads.g.doubleclick.net 1 redirects
1 www.linq.it shorturl.today
1 ajax.googleapis.com shorturl.today
1 goimaginate.com
11 9

This site contains links to these domains. Also see Links.

Domain
www.rackspace.com
cp.rackspace.com
apps.rackspace.com
Subject Issuer Validity Valid
www.goimaginate.com
R3		 2021-10-21 -
2022-01-19		 3 months crt.sh
shorturl.today
cPanel, Inc. Certification Authority		 2021-09-12 -
2021-12-11		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2021-10-04 -
2021-12-27		 3 months crt.sh
linq.it
R3		 2021-09-23 -
2021-12-22		 3 months crt.sh
cp.rackspace.com
Thawte RSA CA 2018		 2020-06-10 -
2022-07-10		 2 years crt.sh
www.googleadservices.com
GTS CA 1C3		 2021-10-04 -
2021-12-27		 3 months crt.sh
www.google.de
GTS CA 1C3		 2021-10-04 -
2021-12-27		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://shorturl.today/wp-content/themes/sketch/r/rack2/index.php
Frame ID: E99FCA241EF7C15F17868CA16FA59863
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Rackspace Webmail: Hosted Email for Business

Page URL History Show full URLs

  1. https://goimaginate.com/ao.php Page URL
  2. https://shorturl.today/wp-content/themes/sketch/r/rack2/index.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

9
Domains

9
Subdomains

7
IPs

4
Countries

104 kB
Transfer

198 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://goimaginate.com/ao.php Page URL
  2. https://shorturl.today/wp-content/themes/sketch/r/rack2/index.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 9
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1040066332/?random=1373591760&cv=9&fst=1634918346829&num=1&value=0&label=gyhyCL7-6AEQnM747wM&bg=666666&hl=en&guid=ON&resp=GooglemKTybQhCsO&eid=375603261&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fshorturl.today%2Fwp-content%2Fthemes%2Fsketch%2Fr%2Frack2%2Findex.php&ref=https%3A%2F%2Fgoimaginate.com%2F&tiba=Rackspace%20Webmail%3A%20Hosted%20Email%20for%20Business&hn=www.googleadservices.com&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=yt9yYar0N4TC-gbAjof4Bg&sscte=1&crd= HTTP 302
  • https://www.google.com/pagead/1p-user-list/1040066332/?random=1373591760&cv=9&fst=1634914800000&num=1&value=0&label=gyhyCL7-6AEQnM747wM&bg=666666&hl=en&guid=ON&eid=375603261&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&frm=0&url=https%3A%2F%2Fshorturl.today%2Fwp-content%2Fthemes%2Fsketch%2Fr%2Frack2%2Findex.php&ref=https%3A%2F%2Fgoimaginate.com%2F&tiba=Rackspace%20Webmail%3A%20Hosted%20Email%20for%20Business&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&crd=&is_vtc=1&random=3823703565&resp=GooglemKTybQhCsO HTTP 302
  • https://www.google.de/pagead/1p-user-list/1040066332/?random=1373591760&cv=9&fst=1634914800000&num=1&value=0&label=gyhyCL7-6AEQnM747wM&bg=666666&hl=en&guid=ON&eid=375603261&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&frm=0&url=https%3A%2F%2Fshorturl.today%2Fwp-content%2Fthemes%2Fsketch%2Fr%2Frack2%2Findex.php&ref=https%3A%2F%2Fgoimaginate.com%2F&tiba=Rackspace%20Webmail%3A%20Hosted%20Email%20for%20Business&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&crd=&is_vtc=1&random=3823703565&resp=GooglemKTybQhCsO&ipr=y

11 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
ao.php
goimaginate.com/ 		107 B
314 B 		Document
General
Check archive.org
Download Go to
Full URL
https://goimaginate.com/ao.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
185.67.0.230 , Netherlands, ASN50673 (SERVERIUS-AS, NL),
Reverse DNS
childstick.com
Software
Apache /
Resource Hash
e72f370294bd5c0da019030dc88065991021f3e06d8a89945caf905e1d38c3a7

Request headers

Host
goimaginate.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Date
Fri, 22 Oct 2021 15:59:06 GMT
Server
Apache
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Primary Request index.php
shorturl.today/wp-content/themes/sketch/r/rack2/ 		14 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://shorturl.today/wp-content/themes/sketch/r/rack2/index.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.162.227.217 , United Kingdom, ASN61323 (UKFAST, GB),
Reverse DNS
server217.geeconglobal.com
Software
Apache /
Resource Hash
300511f70df9826330822f675b8545abaebe05e1ced7c31e38baa6ffa1cf6890

Request headers

:method
GET
:authority
shorturl.today
:scheme
https
:path
/wp-content/themes/sketch/r/rack2/index.php
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://goimaginate.com/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://goimaginate.com/

Response headers

vary
Accept-Encoding,User-Agent
content-encoding
gzip
content-length
3954
content-type
text/html; charset=UTF-8
date
Fri, 22 Oct 2021 15:59:06 GMT
server
Apache
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.10.2/ 		91 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js
Requested by
Host: shorturl.today
URL: https://shorturl.today/wp-content/themes/sketch/r/rack2/index.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.42 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f10.1e100.net
Software
sffe /
Resource Hash
89a15e9c40bc6b14809f236ee8cd3ed1ea42393c1f6ca55c7855cd779b3f922e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://shorturl.today/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 22 Oct 2021 15:18:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2423
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
32954
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="hosted-libraries-pushers"
expires
Sat, 22 Oct 2022 15:18:43 GMT
login.js
shorturl.today/wp-content/themes/sketch/r/rack2/js/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://shorturl.today/wp-content/themes/sketch/r/rack2/js/login.js?2230
Requested by
Host: shorturl.today
URL: https://shorturl.today/wp-content/themes/sketch/r/rack2/index.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.162.227.217 , United Kingdom, ASN61323 (UKFAST, GB),
Reverse DNS
server217.geeconglobal.com
Software
Apache /
Resource Hash

Request headers

:path
/wp-content/themes/sketch/r/rack2/js/login.js?2230
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
shorturl.today
referer
https://shorturl.today/wp-content/themes/sketch/r/rack2/index.php
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://shorturl.today/wp-content/themes/sketch/r/rack2/index.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 22 Oct 2021 15:59:06 GMT
content-encoding
gzip
server
Apache
vary
Accept-Encoding,User-Agent
content-type
text/html; charset=UTF-8
cache-control
no-cache, must-revalidate, max-age=0
set-cookie
PHPSESSID=1d4ddb0dde593f961315f777b0489a83; path=/
link
<https://shorturl.today/wp-json/>; rel="https://api.w.org/"
content-length
1449
expires
Wed, 11 Jan 1984 05:00:00 GMT
rackspace_logo-WHT.png
www.linq.it/wp-content/uploads/ 		35 KB
36 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.linq.it/wp-content/uploads/rackspace_logo-WHT.png
Requested by
Host: shorturl.today
URL: https://shorturl.today/wp-content/themes/sketch/r/rack2/index.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
13.210.234.248 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-13-210-234-248.ap-southeast-2.compute.amazonaws.com
Software
Apache /
Resource Hash
9dc324b43e7a356d917c3b52e44ecdfb998c91d4589ceb24a51793b59724a5d5
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://shorturl.today/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Fri, 22 Oct 2021 15:59:07 GMT
Last-Modified
Tue, 19 Dec 2017 23:50:49 GMT
Server
Apache
ETag
"8d34-560ba22e26840"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=100
Content-Length
36148
blank.gif
cp.rackspace.com/clients/webmail/apps_rackspace_com/images/ 		43 B
329 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cp.rackspace.com/clients/webmail/apps_rackspace_com/images/blank.gif
Requested by
Host: shorturl.today
URL: https://shorturl.today/wp-content/themes/sketch/r/rack2/index.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.130.182.72 San Antonio, United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software
openresty / ASP.NET
Resource Hash
2894fa1d1ebe2f99a165317c3c46ea23a7de28590a1c3965508acaf802e9c9a8

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://shorturl.today/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Fri, 22 Oct 2021 15:59:07 GMT
ETag
"03a78f396d7cb1:0"
Last-Modified
Mon, 28 Feb 2011 22:29:24 GMT
Server
openresty
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
no-cache
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
conversion.js
www.googleadservices.com/pagead/ 		45 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/conversion.js
Requested by
Host: shorturl.today
URL: https://shorturl.today/wp-content/themes/sketch/r/rack2/index.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s53-in-f2.1e100.net
Software
cafe /
Resource Hash
15f6865841563f9690aa73d93d6af4f80c0544d09b1c9f1479c44edd1bec5f6e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://shorturl.today/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 22 Oct 2021 15:59:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
17678
x-xss-protection
0
server
cafe
etag
7688520411956436205
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Fri, 22 Oct 2021 15:59:06 GMT
logo_20141002.png
cp.rackspace.com/clients/webmail/beta_apps_rackspace_com/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cp.rackspace.com/clients/webmail/beta_apps_rackspace_com/images/logo_20141002.png
Requested by
Host: shorturl.today
URL: https://shorturl.today/wp-content/themes/sketch/r/rack2/index.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.130.182.72 San Antonio, United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software
openresty / ASP.NET
Resource Hash
f167dfd881b45166119fce39b1fa639e925f80e4e7391e3cbe83f843490b7b19

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://shorturl.today/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Fri, 22 Oct 2021 15:59:07 GMT
ETag
"7ac0285e65decf1:0"
Last-Modified
Thu, 02 Oct 2014 17:21:56 GMT
Server
openresty
X-Powered-By
ASP.NET
Content-Type
image/png
Cache-Control
no-cache
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2080
affordable_storage.png
cp.rackspace.com/clients/webmail/apps_rackspace_com/images/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cp.rackspace.com/clients/webmail/apps_rackspace_com/images/affordable_storage.png
Requested by
Host: shorturl.today
URL: https://shorturl.today/wp-content/themes/sketch/r/rack2/index.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.130.182.72 San Antonio, United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software
openresty / ASP.NET
Resource Hash
97f66d1ce6f3166037b4d88beb28094657c17a4785c774b6511e0adaef016952

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://shorturl.today/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Fri, 22 Oct 2021 15:59:07 GMT
ETag
"ce2e3c32ec48d31:0"
Last-Modified
Thu, 19 Oct 2017 15:09:01 GMT
Server
openresty
X-Powered-By
ASP.NET
Content-Type
image/png
Cache-Control
no-cache
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
8813
/
www.googleadservices.com/pagead/conversion/1040066332/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/conversion/1040066332/?random=1634918346829&cv=9&fst=1634918346829&num=1&value=0&label=gyhyCL7-6AEQnM747wM&bg=666666&hl=en&guid=ON&resp=GooglemKTybQhCsO&eid=375603261&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fshorturl.today%2Fwp-content%2Fthemes%2Fsketch%2Fr%2Frack2%2Findex.php&ref=https%3A%2F%2Fgoimaginate.com%2F&tiba=Rackspace%20Webmail%3A%20Hosted%20Email%20for%20Business&hn=www.googleadservices.com&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s53-in-f2.1e100.net
Software
cafe /
Resource Hash
6ca70cd84a4cc0c74bdf91d42f74be1963619a521baf813cb22dbb87111721d7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://shorturl.today/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 22 Oct 2021 15:59:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
1189
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/1040066332/
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1040066332/?random=1373591760&cv=9&fst=1634918346829&num=1&value=0&label=gyhyCL7-6AEQnM747wM&bg=666666&hl=en&guid=ON&resp=GooglemKTy...
  • https://www.google.com/pagead/1p-user-list/1040066332/?random=1373591760&cv=9&fst=1634914800000&num=1&value=0&label=gyhyCL7-6AEQnM747wM&bg=666666&hl=en&guid=ON&eid=375603261&u_h=1200&u_w=1600&u_ah=...
  • https://www.google.de/pagead/1p-user-list/1040066332/?random=1373591760&cv=9&fst=1634914800000&num=1&value=0&label=gyhyCL7-6AEQnM747wM&bg=666666&hl=en&guid=ON&eid=375603261&u_h=1200&u_w=1600&u_ah=1...
42 B
519 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/1040066332/?random=1373591760&cv=9&fst=1634914800000&num=1&value=0&label=gyhyCL7-6AEQnM747wM&bg=666666&hl=en&guid=ON&eid=375603261&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&frm=0&url=https%3A%2F%2Fshorturl.today%2Fwp-content%2Fthemes%2Fsketch%2Fr%2Frack2%2Findex.php&ref=https%3A%2F%2Fgoimaginate.com%2F&tiba=Rackspace%20Webmail%3A%20Hosted%20Email%20for%20Business&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&crd=&is_vtc=1&random=3823703565&resp=GooglemKTybQhCsO&ipr=y
Requested by
Host: shorturl.today
URL: https://shorturl.today/wp-content/themes/sketch/r/rack2/index.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.35 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f3.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://shorturl.today/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 22 Oct 2021 15:59:07 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 22 Oct 2021 15:59:07 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
image/gif
location
https://www.google.de/pagead/1p-user-list/1040066332/?random=1373591760&cv=9&fst=1634914800000&num=1&value=0&label=gyhyCL7-6AEQnM747wM&bg=666666&hl=en&guid=ON&eid=375603261&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&frm=0&url=https%3A%2F%2Fshorturl.today%2Fwp-content%2Fthemes%2Fsketch%2Fr%2Frack2%2Findex.php&ref=https%3A%2F%2Fgoimaginate.com%2F&tiba=Rackspace%20Webmail%3A%20Hosted%20Email%20for%20Business&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&crd=&is_vtc=1&random=3823703565&resp=GooglemKTybQhCsO&ipr=y
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Rackspace (Online)

57 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster function| $ function| jQuery boolean| _wm_redirect object| google_conversion_id object| google_conversion_language object| google_conversion_format object| google_conversion_color object| google_conversion_label object| google_conversion_value function| GooglemKTybQhCsO object| google_conversion_date object| google_conversion_time number| google_conversion_snippets number| google_conversion_first_time object| google_conversion_js_version object| google_enable_display_cookie_match object| google_tag_data object| google_conversion_type object| google_conversion_order_id object| google_conversion_currency object| google_conversion_domain object| google_disable_viewthrough object| google_gtag_event_data object| google_remarketing_only object| google_conversion_linker object| google_tag_for_child_directed_treatment object| google_tag_for_under_age_of_consent object| google_allow_ad_personalization_signals object| google_restricted_data_processing object| google_conversion_items object| google_conversion_merchant_id object| google_user_id object| google_custom_params object| onload_callback object| opt_image_generator object| google_gtm_url_processor object| google_conversion_page_url object| google_conversion_referrer_url object| google_gtm object| google_gcl_cookie_prefix object| google_gcl_cookie_path object| google_gcl_cookie_flags object| google_gcl_cookie_domain object| google_gcl_cookie_max_age_seconds object| google_read_gcl_cookie_opt_out object| google_basket_feed_country object| google_basket_feed_language object| google_basket_discount object| google_basket_transaction_type object| google_additional_conversion_params object| google_additional_params object| google_transport_url object| google_gtm_experiments function| onFormSubmit string| _ext_js_path

2 Cookies

Domain/Path Name / Value
shorturl.today/ Name: PHPSESSID
Value: 1d4ddb0dde593f961315f777b0489a83
.doubleclick.net/ Name: test_cookie
Value: CheckForPermission

1 Console Messages

Source Level URL
Text
network error URL: https://shorturl.today/wp-content/themes/sketch/r/rack2/js/login.js?2230
Message:
Failed to load resource: the server responded with a status of 404 ()