20bet.com Open in urlscan Pro
172.64.149.211 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://api5000.bitgetexchange.online/
Effective URL:
https://20bet.com/fi/casino?btag=670327_516645FBAA914D51AC26D80095ED9514
Submission Tags: @phish_report
Submission: On January 04 via api (January 4th 2024, 3:56:16 am UTC) from FI — Scanned from FI

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 11 domains to perform 14 HTTP transactions. The main IP is 172.64.149.211, located in and belongs to . The main domain is 20bet.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on March 21st 2023. Valid for: a year.

This is the only time 20bet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	72.167.50.80 72.167.50.80	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC)
1 4	172.67.202.185 172.67.202.185	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	13.107.246.45 13.107.246.45	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	3.78.64.203 3.78.64.203	16509 (AMAZON-02) (AMAZON-02)
1 2	172.64.149.211 172.64.149.211	() ()
14	3

1 72.167.50.80 (United States) 1 redirects

ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: 80.50.167.72.host.secureserver.net

api5000.bitgetexchange.online	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.67.202.185 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

20bet-de.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.246.45 (United States) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

promo.20bet.partners	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.78.64.203 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-78-64-203.eu-central-1.compute.amazonaws.com

20media.world	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.64.149.211 (None, ) 1 redirects

ASN- ()

20bet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	20bet-de.net 1 redirects 20bet-de.net	6 KB
2	20bet.com 1 redirects 20bet.com	519 B
1	20media.world 1 redirects 20media.world — Cisco Umbrella Rank: 419970	116 B
1	20bet.partners 1 redirects promo.20bet.partners — Cisco Umbrella Rank: 577804	791 B
1	bitgetexchange.online 1 redirects api5000.bitgetexchange.online	112 B
0	antillephone.com Failed c4457c89-e5ba-4d22-92e5-c2959310ee85.snippet.antillephone.com Failed
0	cloudfront.net Failed dwmu1hf7ovvid.cloudfront.net Failed
0	onesignal.com Failed cdn.onesignal.com Failed
0	seon.io Failed cdn.seon.io Failed
0	a8r.games Failed casino.cur.a8r.games Failed
0	googleapis.com Failed fonts.googleapis.com Failed
14	11

	Domain	Requested by
4	20bet-de.net	1 redirects 20bet-de.net
2	20bet.com	1 redirects 20bet.com
1	20media.world	1 redirects
1	promo.20bet.partners	1 redirects
1	api5000.bitgetexchange.online	1 redirects
0	c4457c89-e5ba-4d22-92e5-c2959310ee85.snippet.antillephone.com Failed	20bet.com
0	dwmu1hf7ovvid.cloudfront.net Failed	20bet.com
0	cdn.onesignal.com Failed	20bet.com
0	cdn.seon.io Failed	20bet.com
0	casino.cur.a8r.games Failed	20bet.com
0	fonts.googleapis.com Failed	20bet.com
14	11

This site contains no links.

Subject Issuer	Validity	Valid
20bet-de.net GTS CA 1P5	`2023-12-15` - `2024-03-14`	3 months	crt.sh
20bet.com Cloudflare Inc ECC CA-3	`2023-03-21` - `2024-03-19`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://20bet.com/fi/casino?btag=670327_516645FBAA914D51AC26D80095ED9514
Frame ID: AAE6A939FFFC6347A6B572E4B6E187C8
Requests: 12 HTTP requests in this frame

Frame: https://20bet-de.net/cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/main.js
Frame ID: 924446C2EEED8BB01FEE8E8EF40510D9
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://api5000.bitgetexchange.online/ HTTP 301
https://20bet-de.net/g.html Page URL
https://promo.20bet.partners/redirect.aspx?pid=257682&bid=1971&lpid=281 HTTP 307
https://20media.world/casino?btag=670327_516645FBAA914D51AC26D80095ED9514 HTTP 302
https://20bet.com/casino?btag=670327_516645FBAA914D51AC26D80095ED9514 HTTP 302
https://20bet.com/fi/casino?btag=670327_516645FBAA914D51AC26D80095ED9514 Page URL

Page Statistics

14
Requests

21 %
HTTPS

0 %
IPv6

11
Domains

11
Subdomains

3
IPs

2
Countries

5 kB
Transfer

40 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://api5000.bitgetexchange.online/ HTTP 301
https://20bet-de.net/g.html Page URL
https://promo.20bet.partners/redirect.aspx?pid=257682&bid=1971&lpid=281 HTTP 307
https://20media.world/casino?btag=670327_516645FBAA914D51AC26D80095ED9514 HTTP 302
https://20bet.com/casino?btag=670327_516645FBAA914D51AC26D80095ED9514 HTTP 302
https://20bet.com/fi/casino?btag=670327_516645FBAA914D51AC26D80095ED9514 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://api5000.bitgetexchange.online/ HTTP 301
https://20bet-de.net/g.html

Request Chain 1

https://20bet-de.net/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
https://20bet-de.net/cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/main.js

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

g.html Show response
20bet-de.net/
Redirect Chain

https://api5000.bitgetexchange.online/
https://20bet-de.net/g.html

1 KB
1 KB

1593ms
334ms

Document
text/html

172.67.202.185
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://20bet-de.net/g.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.202.185 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 91e9b4253c3f736af93e3ab84d4f125ff48d204363abfd64498d6c5ae5852037

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: fi-FI,fi;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 84008cda2c2ad94b-HEL
content-encoding: br
content-type: text/html
date: Thu, 04 Jan 2024 03:56:11 GMT
last-modified: Thu, 28 Dec 2023 05:19:29 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hBxXTPwdM8%2F6diZwgmcN3VDnJcXm%2Fu0YoGgKI8FIe%2FbAaeiX4Qt%2B8itt9wWrm%2FUxc%2B8PcrcZb%2F3K2iMWzRznHCijWLkVoVd9FejiQNN9GzHYT2EPftWpGmCsOj7A1us%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

Redirect headers

content-length: 162
content-type: text/html
date: Thu, 04 Jan 2024 03:56:09 GMT
location: https://20bet-de.net/g.html
server: nginx
strict-transport-security: max-age=31536000

GET
H2

200

main.js
20bet-de.net/cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/ Frame 9244
Redirect Chain

https://20bet-de.net/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://20bet-de.net/cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/main.js

7 KB
4 KB

600ms
600ms

Script
application/javascript

172.67.202.185
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://20bet-de.net/cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/main.js

Protocol

Server

172.67.202.185 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: fi-FI,fi;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 03:56:12 GMT
content-encoding: br
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=N0Pqqq12iQ3waDw9%2FuO%2BpD6UQv6NEPFezBC2TVjiCgQzdIThFk2g%2FxtLRP%2FdO%2FQTzC6vmcmDAvkk8wYPEcQ6UtLFSERJj4hnjtos%2BMsOZmfocbdNns2S0lz8uNc4Uo8%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
cf-ray: 84008ce1ea89d94b-HEL
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Thu, 04 Jan 2024 03:56:11 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pGefgC2%2BmGlB12tU%2BCVvVP5lRLVuwTCScTxJAKqdwKrX6Y4e0jlZfon%2Fsbzf9%2B60GRX9pFemb27TwdmbcmPDppPoCdS3dampsgCSKMzJ0NLHp3FrbzUxOVldgKCL4HU%3D"}],"group":"cf-nel","max_age":604800}
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/main.js
access-control-allow-origin: *
cache-control: max-age=300, public
cf-ray: 84008cddbf1fd94b-HEL
alt-svc: h3=":443"; ma=86400

GET
H2

200

Primary Request casino
20bet.com/fi/
Redirect Chain

https://promo.20bet.partners/redirect.aspx?pid=257682&bid=1971&lpid=281
https://20media.world/casino?btag=670327_516645FBAA914D51AC26D80095ED9514
https://20bet.com/casino?btag=670327_516645FBAA914D51AC26D80095ED9514
https://20bet.com/fi/casino?btag=670327_516645FBAA914D51AC26D80095ED9514

31 KB
0

372ms
371ms

Document
text/html

172.64.149.211

General

Check archive.org

Show headers Download Go to

Full URL: https://20bet.com/fi/casino?btag=670327_516645FBAA914D51AC26D80095ED9514
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.149.211 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://20bet-de.net/g.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: fi-FI,fi;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
access-control-allow-methods: GET, POST, OPTIONS
access-control-expose-headers: Content-Length,Content-Range
cache-control: no-cache, private
cf-cache-status: DYNAMIC
cf-ray: 84008cfa38274c8c-HEL
content-encoding: br
content-type: text/html; charset=UTF-8
date: Thu, 04 Jan 2024 03:56:16 GMT
server: cloudflare
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
access-control-allow-methods: GET, POST, OPTIONS
access-control-expose-headers: Content-Length,Content-Range
cache-control: no-cache, private
cf-cache-status: DYNAMIC
cf-ray: 84008cf6ffd14c8c-HEL
content-type: text/html; charset=UTF-8
date: Thu, 04 Jan 2024 03:56:15 GMT
location: /fi/casino?btag=670327_516645FBAA914D51AC26D80095ED9514
server: cloudflare

POST
H2 200 84008cda2c2ad94b
20bet-de.net/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame 9244 0
439 B 188ms
188ms XHR
text/plain 172.67.202.185
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://20bet-de.net/cdn-cgi/challenge-platform/h/g/jsd/r/84008cda2c2ad94b
Requested by: Host: 20bet-de.net
URL: https://20bet-de.net/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.202.185 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer
accept-language: fi-FI,fi;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 04 Jan 2024 03:56:12 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GtteRLTFKIfuPgep%2BKkEx1sNoKxaE7RHTTnKPvJipV9G93D24KTcrjTsGf9D8yEhOSOwsAwz8PnaLgdPNupdeEAMokBqWodMDvxG2n%2F2d99fI260ixiaXi2lNBDhC8E%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=UTF-8
cf-ray: 84008ce3af2cd94b-HEL
alt-svc: h3=":443"; ma=86400

GET css
fonts.googleapis.com/ 0
0

GET styles.1d6bae22ab2f62dc.css
20bet.com/app/ 0
0

GET sg.js
casino.cur.a8r.games/public/ 0
0

GET agent.js
cdn.seon.io/js/v4/ 0
0

GET configuration.js
20bet.com/ 0
0

GET OneSignalSDK.js
cdn.onesignal.com/sdks/ 0
0

GET 8c148489-24f4-4dd1-b32e-de16ea683976_20betchristmasloader.gif
dwmu1hf7ovvid.cloudfront.net/site/upload/custom_asset/ 0
0

GET apg-seal.js
c4457c89-e5ba-4d22-92e5-c2959310ee85.snippet.antillephone.com/ 0
0

GET 1674827467_1674826113_google01.webp
dwmu1hf7ovvid.cloudfront.net/site/upload/license_validation/9458241d-0da8-43ca-aac4-b1756ce0ba65/ 0
0

GET 1681397650_light-corg-award-6.svg
dwmu1hf7ovvid.cloudfront.net/site/upload/license_validation/cdf206e5-4a63-486d-b209-923a199eb870/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500,700,300,900&display=swap&subset=cyrillic

Domain: 20bet.com
URL: https://20bet.com/app/styles.1d6bae22ab2f62dc.css

Domain: casino.cur.a8r.games
URL: https://casino.cur.a8r.games/public/sg.js

Domain: cdn.seon.io
URL: https://cdn.seon.io/js/v4/agent.js

Domain: 20bet.com
URL: https://20bet.com/configuration.js?v=123

Domain: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js

Domain: dwmu1hf7ovvid.cloudfront.net
URL: https://dwmu1hf7ovvid.cloudfront.net/site/upload/custom_asset/8c148489-24f4-4dd1-b32e-de16ea683976_20betchristmasloader.gif

Domain: c4457c89-e5ba-4d22-92e5-c2959310ee85.snippet.antillephone.com
URL: https://c4457c89-e5ba-4d22-92e5-c2959310ee85.snippet.antillephone.com/apg-seal.js

Domain: dwmu1hf7ovvid.cloudfront.net
URL: https://dwmu1hf7ovvid.cloudfront.net/site/upload/license_validation/9458241d-0da8-43ca-aac4-b1756ce0ba65/1674827467_1674826113_google01.webp

Domain: dwmu1hf7ovvid.cloudfront.net
URL: https://dwmu1hf7ovvid.cloudfront.net/site/upload/license_validation/cdf206e5-4a63-486d-b209-923a199eb870/1681397650_light-corg-award-6.svg

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.20bet-de.net/	1970-01-21 02:11:16	Name: cf_clearance Value: _Z544146qqb1Bqc1ebVFkXyGQPpNXu8VLgE0YJ0vPXA-1704340572-0-2-79cef365.4a3a3420.2ecfac85-0.2.1704340572
.20bet.partners/	1970-01-21 03:01:40	Name: NetRefer_CookieUniTrack_C Value: %5b%7b%22PID%22%3a257682%2c%22BID%22%3a1971%2c%22DateTimeStamp%22%3a%22%5c%2fDate(1704340572798)%5c%2f%22%2c%22CookieTag%22%3a%2219712576825473100178C202414356%22%7d%5d
.20bet.partners/	1970-01-21 03:01:40	Name: NetReferSPS Value: %5b%7b%22StoreName%22%3a%22CurrentReferenceID%22%2c%22StoreValue%22%3a%222223057234%7c1%22%7d%5d

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

20bet-de.net
20bet.com
20media.world
api5000.bitgetexchange.online
c4457c89-e5ba-4d22-92e5-c2959310ee85.snippet.antillephone.com
casino.cur.a8r.games
cdn.onesignal.com
cdn.seon.io
dwmu1hf7ovvid.cloudfront.net
fonts.googleapis.com
promo.20bet.partners
20bet.com
c4457c89-e5ba-4d22-92e5-c2959310ee85.snippet.antillephone.com
casino.cur.a8r.games
cdn.onesignal.com
cdn.seon.io
dwmu1hf7ovvid.cloudfront.net
fonts.googleapis.com
13.107.246.45
172.64.149.211
172.67.202.185
3.78.64.203
72.167.50.80
91e9b4253c3f736af93e3ab84d4f125ff48d204363abfd64498d6c5ae5852037

20bet.com Open in urlscan Pro 172.64.149.211 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

14 Requests

21 %HTTPS

0 %IPv6

11 Domains

11 Subdomains

3 IPs

2 Countries

5 kBTransfer

40 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

3 Cookies

Indicators

20bet.com Open in urlscan Pro
172.64.149.211 Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

21 %
HTTPS

0 %
IPv6

11
Domains

11
Subdomains

3
IPs

2
Countries

5 kB
Transfer

40 kB
Size

3
Cookies

14 HTTP transactions
0 data transactions