wwu.resgatepts.online Open in urlscan Pro
2a06:98c1:3120::3  Malicious Activity! Public Scan

Submitted URL: http://appresgateptssite.online/
Effective URL: https://wwu.resgatepts.online/
Submission: On November 08 via api from BR — Scanned from DE

Summary

This website contacted 1 IPs in 2 countries across 2 domains to perform 10 HTTP transactions. The main IP is 2a06:98c1:3120::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is wwu.resgatepts.online.
TLS certificate: Issued by E1 on October 31st 2023. Valid for: 3 months.
This is the only time wwu.resgatepts.online was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Livelo (E-commerce)

Domain & IP information

IP Address AS Autonomous System
1 1 62.3.58.85 212913 (TIMEHOST-AS)
1 11 2a06:98c1:312... 13335 (CLOUDFLAR...)
10 1
Apex Domain
Subdomains
Transfer
11 resgatepts.online
wwu.resgatepts.online
120 KB
1 appresgateptssite.online
appresgateptssite.online
250 B
10 2
Domain Requested by
11 wwu.resgatepts.online 1 redirects wwu.resgatepts.online
1 appresgateptssite.online 1 redirects
10 2

This site contains no links.

Subject Issuer Validity Valid
resgatepts.online
E1
2023-10-31 -
2024-01-29
3 months crt.sh

This page contains 1 frames:

Primary Page: https://wwu.resgatepts.online/
Frame ID: F9229BFA48D805984ABBC87827B9E015
Requests: 10 HTTP requests in this frame

Screenshot

Page Title

livelo

Page URL History Show full URLs

  1. http://appresgateptssite.online/ HTTP 301
    http://wwu.resgatepts.online/ HTTP 301
    https://wwu.resgatepts.online/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <[^>]+\sdata-v(?:ue)?-

Page Statistics

10
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

120 kB
Transfer

283 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://appresgateptssite.online/ HTTP 301
    http://wwu.resgatepts.online/ HTTP 301
    https://wwu.resgatepts.online/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
wwu.resgatepts.online/
Redirect Chain
  • http://appresgateptssite.online/
  • http://wwu.resgatepts.online/
  • https://wwu.resgatepts.online/
739 B
941 B
Document
General
Full URL
https://wwu.resgatepts.online/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9a5006e51390a8b3bc0a24cc87d842f874a33a0c8ae5fd5eaae2cdd3ddfb234a

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
822dfe2089126951-FRA
content-encoding
br
content-type
text/html; charset=utf-8
date
Wed, 08 Nov 2023 12:59:21 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MsRx5qnhUbZ%2FZBPwjKTXVRDt%2FnT7jT5mmx7kxhKYbXM3PAdv47HglJXzspubLCxcqc1%2F1u0AZFIOBPriPVV4jDFAb%2FJDVaJ5L3B5qfNK7vZBrz%2Fj0x4H2NPN0%2B0ZaRtZOqVkSzoJZV%2FSX6IHLq2oM8tsWRg%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding

Redirect headers

CF-RAY
822dfe203c969a00-FRA
Cache-Control
max-age=3600
Connection
keep-alive
Date
Wed, 08 Nov 2023 12:59:21 GMT
Expires
Wed, 08 Nov 2023 13:59:21 GMT
Location
https://wwu.resgatepts.online/
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iXeRpmbUVoBLjaaxVilNdJfOhidzIeOuXckkICFdRoHGc%2BDfEpJRxeL7s9aw5EH5DQJgTWGCmVi5jrDBcEJQxvlLcJItQ5fPpnEbcfhwoNLy0jFikZIBQ5MiSAtI1AwyvwiUczsJw83p0MYDhdfRjRElO9k%3D"}],"group":"cf-nel","max_age":604800}
Server
cloudflare
Transfer-Encoding
chunked
Vary
Accept-Encoding
alt-svc
h3=":443"; ma=86400
chunk-vendors.1a3e10a8.js
wwu.resgatepts.online/js/
216 KB
78 KB
Script
General
Full URL
https://wwu.resgatepts.online/js/chunk-vendors.1a3e10a8.js
Requested by
Host: wwu.resgatepts.online
URL: https://wwu.resgatepts.online/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
baa582f17e15f36d5f466ca812a1ddd9adf561ca38bb70f7141822198254c87c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wwu.resgatepts.online/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date
Wed, 08 Nov 2023 12:59:21 GMT
content-encoding
br
cf-cache-status
BYPASS
last-modified
Tue, 31 Oct 2023 16:29:14 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kLDgw6bgR%2B2YM0h3vEMBR6lifgqw45MYaxqiSIwH6V2XI36xSHvJgSaiy%2FTtS18PAQb4nbEnZHomtsQucTfdN7MiG5AK9NdTFXDUKUVYstP7iZNW38%2Fm0MwHKxUwKMuLYieW8%2Bc9S3quYVWLU8CXSbOpSwA%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
no-cache
content-disposition
inline; filename=chunk-vendors.1a3e10a8.js
cf-ray
822dfe20f9a36951-FRA
alt-svc
h3=":443"; ma=86400
app.f603692d.js
wwu.resgatepts.online/js/
26 KB
7 KB
Script
General
Full URL
https://wwu.resgatepts.online/js/app.f603692d.js
Requested by
Host: wwu.resgatepts.online
URL: https://wwu.resgatepts.online/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
376349038ea0361e3e85caccea1faf6d2076e7e7d68cbbc8c117eda7e692302e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wwu.resgatepts.online/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date
Wed, 08 Nov 2023 12:59:21 GMT
content-encoding
br
cf-cache-status
BYPASS
last-modified
Tue, 31 Oct 2023 16:29:15 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zRhhSDCcaW6ERVTXJT3jOT0IIwW8jJ4VYtP6AQaFnPNFnmRY%2FV%2FuL11Ay5rJz9bicnzkRkBzxqa3PvMIDi1JMKMmXBIrHTlDKOy%2BMQ54gz5y%2FbVsCJEVBEyFVZZYCwnvzyf3oF3%2Fic6ndej4QIIj20OVItw%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
no-cache
content-disposition
inline; filename=app.f603692d.js
cf-ray
822dfe20f9a46951-FRA
alt-svc
h3=":443"; ma=86400
app.66ec128e.css
wwu.resgatepts.online/css/
6 KB
2 KB
Stylesheet
General
Full URL
https://wwu.resgatepts.online/css/app.66ec128e.css
Requested by
Host: wwu.resgatepts.online
URL: https://wwu.resgatepts.online/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5fa223e08fb1cabafc88f01f0aa1eba6b5453630f880e2044c7ba83fe946ca7a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wwu.resgatepts.online/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date
Wed, 08 Nov 2023 12:59:21 GMT
content-encoding
br
cf-cache-status
BYPASS
last-modified
Tue, 31 Oct 2023 16:29:06 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8zDqjCALGxHpZzgwJnTF2uR3uma1HieRwDMyWGBOE2%2FEs%2BeQNQC3pyGbcDarEZ1LnVP34TCuYJdpD5%2FvfLxGMXNTobBsPhwkDCSeRzCtTQxvztIu7HGhZZhYx9jjBasSdVas24SgwgyWiOOugm9lNIxe3%2Bs%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
no-cache
content-disposition
inline; filename=app.66ec128e.css
cf-ray
822dfe20f9a26951-FRA
alt-svc
h3=":443"; ma=86400
684639ae-2634-4a4b-bed7-142b65e67d60
wwu.resgatepts.online/2e3e21b3-0b32-4594-83a4-36e053a9bda2/api/
41 B
589 B
XHR
General
Full URL
https://wwu.resgatepts.online/2e3e21b3-0b32-4594-83a4-36e053a9bda2/api/684639ae-2634-4a4b-bed7-142b65e67d60
Requested by
Host: wwu.resgatepts.online
URL: https://wwu.resgatepts.online/js/chunk-vendors.1a3e10a8.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
750fd2230014a4a420ad792b29e1c59d92424bafe4fc38fd572b263087de4a00

Request headers

Accept
application/json, text/plain, */*
Referer
https://wwu.resgatepts.online/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date
Wed, 08 Nov 2023 12:59:21 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AJvCi0MfLjj%2BmQBErgqvDjojYM8pMhjrzW4ObQ5mBIjuR7xH%2BUN8V5NzcOLOZ0febBHU7lRyE498UX6jQbyKQUUd9tg%2BWYosEtSn34Vs5cvzLUQKUA4WBspKnP4lM1Tq%2FhPeMqTRfWMTnx7sExqvWlgVHhc%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/json
access-control-allow-origin
https://wwu.resgatepts.online
cf-ray
822dfe21ed963a54-FRA
alt-svc
h3=":443"; ma=86400
content-length
41
logo1.2c7a4267.svg
wwu.resgatepts.online/img/
5 KB
3 KB
Image
General
Full URL
https://wwu.resgatepts.online/img/logo1.2c7a4267.svg
Requested by
Host: wwu.resgatepts.online
URL: https://wwu.resgatepts.online/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a93839a2c1e9457a6a66474a128ae6221798e5fec089c172e8160b592584dd93

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wwu.resgatepts.online/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date
Wed, 08 Nov 2023 12:59:21 GMT
content-encoding
br
cf-cache-status
BYPASS
last-modified
Thu, 02 Nov 2023 03:24:29 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CeHsfGl36298nepuWNXEwdFJevFNw1JCjsADgzc%2F8QeZ7ak3zUeMmsJal1E%2FZWPKp%2FihMuBx6Sn1WrtT%2BHRLynh%2B6S5RHF%2FMr%2Fnr2mPEtXStHkJlbRGkpQXOh6mK5%2Bvi%2B2zzUMB3G7j26E14lss%2F6jzvWxk%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/svg+xml; charset=utf-8
access-control-allow-origin
*
cache-control
no-cache
content-disposition
inline; filename=logo1.2c7a4267.svg
cf-ray
822dfe21ed993a54-FRA
alt-svc
h3=":443"; ma=86400
logo2.5907da53.svg
wwu.resgatepts.online/img/
803 B
1001 B
Image
General
Full URL
https://wwu.resgatepts.online/img/logo2.5907da53.svg
Requested by
Host: wwu.resgatepts.online
URL: https://wwu.resgatepts.online/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3becca4e7dd1d0511eabf978dfb1bd8aa48a1b18a31e70fe376a3ccf8d20189a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wwu.resgatepts.online/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date
Wed, 08 Nov 2023 12:59:21 GMT
content-encoding
br
cf-cache-status
BYPASS
last-modified
Thu, 02 Nov 2023 15:10:12 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UgZSNDB8TO2iEpS9sCM7a71U1K5%2BUyidnZjKWjpEb8SPy50dAyxtUnoi3VH5y%2BujaJHI2sZY8BsG3n7QTUOw76ySnn%2BvkVh1uLXmrOB1hvDOpWX42PhzfgqFCIXnXkpQGviAR7T%2B3KCmNPsaPdF1ktqeDyk%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/svg+xml; charset=utf-8
access-control-allow-origin
*
cache-control
no-cache
content-disposition
inline; filename=logo2.5907da53.svg
cf-ray
822dfe21ed9b3a54-FRA
alt-svc
h3=":443"; ma=86400
1.776fc6b1.woff2
wwu.resgatepts.online/fonts/
23 KB
24 KB
Font
General
Full URL
https://wwu.resgatepts.online/fonts/1.776fc6b1.woff2
Requested by
Host: wwu.resgatepts.online
URL: https://wwu.resgatepts.online/css/app.66ec128e.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
72dc37dd92ac41a904175b927273429d71ca73c3294a8c30e7de96f364495c25

Request headers

Referer
https://wwu.resgatepts.online/css/app.66ec128e.css
Origin
https://wwu.resgatepts.online
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date
Wed, 08 Nov 2023 12:59:21 GMT
cf-cache-status
BYPASS
last-modified
Wed, 08 Nov 2023 01:04:18 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ro3N9ieJ%2FLQQEWd5ygyTaKBxreO%2BKGfgIsRRhu%2Fwkc1iiNp6iRDqnlRBUMx5KIdECt21XzytcIH4yFORtRAXnXIY%2BqtJLRztkPycyS3FlN%2BF7Vb9PcjtVgO3%2F3WVEx%2Bzpt1gbNJnoPQASiKUGWWyBrBO1WI%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/octet-stream
access-control-allow-origin
https://wwu.resgatepts.online
cache-control
no-cache
content-disposition
inline; filename=1.776fc6b1.woff2
accept-ranges
bytes
cf-ray
822dfe21ed9c3a54-FRA
alt-svc
h3=":443"; ma=86400
content-length
23756
logo1.2c7a4267.svg
wwu.resgatepts.online/img/
5 KB
3 KB
Image
General
Full URL
https://wwu.resgatepts.online/img/logo1.2c7a4267.svg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a93839a2c1e9457a6a66474a128ae6221798e5fec089c172e8160b592584dd93

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wwu.resgatepts.online/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date
Wed, 08 Nov 2023 12:59:24 GMT
content-encoding
br
cf-cache-status
BYPASS
last-modified
Thu, 02 Nov 2023 03:24:29 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m2JiRwrMKIRNu8i7idJFD8nU07Z0PspvdKdNZsak8eEadQxM1kQ%2BCPKBVLSv9LNvWOXFmu7U1JaqeTRE952SKn6SGD6JRplP%2BWaDAgg1T8D1U5uXakHamznNAP%2BoGhG7Gy9ewfdE%2Fht%2BQZG%2Bkrd4s3erbsE%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/svg+xml; charset=utf-8
access-control-allow-origin
*
cache-control
no-cache
content-disposition
inline; filename=logo1.2c7a4267.svg
cf-ray
822dfe34fdce3a54-FRA
alt-svc
h3=":443"; ma=86400
logo2.5907da53.svg
wwu.resgatepts.online/img/
803 B
995 B
Image
General
Full URL
https://wwu.resgatepts.online/img/logo2.5907da53.svg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3becca4e7dd1d0511eabf978dfb1bd8aa48a1b18a31e70fe376a3ccf8d20189a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wwu.resgatepts.online/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date
Wed, 08 Nov 2023 12:59:24 GMT
content-encoding
br
cf-cache-status
BYPASS
last-modified
Thu, 02 Nov 2023 15:10:12 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=a9ZslY7Kj60a%2FpOLooJyqoMILmPO1LMm2S88c6247M0qtZIB1EpVMLcbgw8sBjJwV3zGrcgFEuo9y%2FoaRVxVTWLxx6P95tm27kUp8f6p15ef50DmqCupuCzKvLFpyEVa37gN69NVwdDQoqbPtr24BkMApN8%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/svg+xml; charset=utf-8
access-control-allow-origin
*
cache-control
no-cache
content-disposition
inline; filename=logo2.5907da53.svg
cf-ray
822dfe34fdd03a54-FRA
alt-svc
h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Livelo (E-commerce)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture string| MSGEND string| MSGINI string| SERVER_URL object| webpackChunklivelo object| __VUE_INSTANCE_SETTERS__ boolean| __VUE__

1 Cookies

Domain/Path Name / Value
wwu.resgatepts.online/ Name: session
Value: 7cc91323-fb2c-431d-b47a-f99b8e127f4a