www.nltopoffers.com
Open in
urlscan Pro
2606:4700:3036::ac43:ac9d
Malicious Activity!
Public Scan
Effective URL: https://www.nltopoffers.com/ntsskg/nl/index-uni.html?cep=cL6alnK8Dzhp3akeQZf9RaZ84p9bre91uEnmPDCmgMumZIJNWn1CZqiBoxwIl-EByc1...
Submission: On January 28 via manual from RO
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 28th 2020. Valid for: a year.
This is the only time www.nltopoffers.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Google (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 13.224.194.68 13.224.194.68 | 16509 (AMAZON-02) (AMAZON-02) | |
1 1 | 38.122.162.114 38.122.162.114 | 174 (COGENT-174) (COGENT-174) | |
1 1 | 18.195.174.160 18.195.174.160 | 16509 (AMAZON-02) (AMAZON-02) | |
14 | 2606:4700:303... 2606:4700:3036::ac43:ac9d | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:824::200a | 15169 (GOOGLE) (GOOGLE) | |
15 | 3 |
ASN16509 (AMAZON-02, US)
PTR: server-13-224-194-68.fra2.r.cloudfront.net
ereenerall.fun |
ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-174-160.eu-central-1.compute.amazonaws.com
first.camptrck.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
nltopoffers.com
www.nltopoffers.com |
226 KB |
1 |
googleapis.com
ajax.googleapis.com |
29 KB |
1 |
camptrck.com
1 redirects
first.camptrck.com |
2 KB |
1 |
1post4all.com
1 redirects
us.1post4all.com |
553 B |
1 |
ereenerall.fun
1 redirects
ereenerall.fun |
581 B |
15 | 5 |
Domain | Requested by | |
---|---|---|
14 | www.nltopoffers.com |
www.nltopoffers.com
|
1 | ajax.googleapis.com |
www.nltopoffers.com
|
1 | first.camptrck.com | 1 redirects |
1 | us.1post4all.com | 1 redirects |
1 | ereenerall.fun | 1 redirects |
15 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
first.camptrck.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-07-28 - 2021-07-28 |
a year | crt.sh |
upload.video.google.com GTS CA 1O1 |
2021-01-05 - 2021-03-30 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.nltopoffers.com/ntsskg/nl/index-uni.html?cep=cL6alnK8Dzhp3akeQZf9RaZ84p9bre91uEnmPDCmgMumZIJNWn1CZqiBoxwIl-EByc1gDMJksqiy7AdB-AHDXJMTBkWeaMxVyQ5mBIvqpQYlK_RDlxPlW7_p4wvRMZlCMjY8V9WdDsbceEMbQX5SKlPZ5SZyXQCUSdjd7BbiPskaDD0NvbZYaclfo0br3_JSdBuPGeiwVmEll8xs17h5FMYTT45yRfNxtlgtjI5ByB_HWYXR1YRbLmjCDQw1cIaVDofVvufzRU33ELSItCOH5tFsKyyp2cBpE0gxw83hFv6e3sDaMpFNjmcbzOujRQArU0vFvpQ3ZHzQUeO_WY1nlsEfVLeqjVea9aARRBimRgpY0lwmnKeiv6-IeGIvalI_p_IKXszjCCvnsvM6ZE-q65EvEM2fngN8oGMcqfDSnMxfMoTieDN2I1wwiNMGYCEiExVOCgcBDKB1-kHhJN4krbZvkRcm7un6c6KoF6Y_6cBz7uKR3SMp-qBj5T2h9vVj1dqFi9hUar8rG7IkLU3fxzl58QFZF560-R5FUJj0LIN4xkUhs9KQpUJNI8EsofBd&lptoken=1632112a841694a862f8&pubid=7e8b430adcae5d6ac0f411155a99c052&siteid=28dddc59cbae045ec019f2798ae7a255&sitesectionid=9d56a1b8b926f361c4e0e86624a83874&sublistid=3293&creativeid=1985633&modif=1&cost=0.0122&campaignid=2028171&usfre=yes
Frame ID: 177A64FC6807BB68F825781D5F2D775F
Requests: 26 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://ereenerall.fun/?tid=905617&utx?cb=El5BLmTQ7TJp&top=femefun.com
HTTP 302
https://us.1post4all.com/log?action=click&key=v2-1611847661090-7-3293-950803-c11e9be3-879a-49fc-83a8-... HTTP 302
https://first.camptrck.com/d4ba2e9f-6798-4cd6-8c4c-5a42f14b8e7f?pubid=7e8b430adcae5d6ac0f411155a99c052&... HTTP 302
https://www.nltopoffers.com/ntsskg/nl/index-uni.html?cep=cL6alnK8Dzhp3akeQZf9RaZ84p9bre91uEnmPDCmgMumZIJ... Page URL
Detected technologies
Amazon Web Services (PaaS) ExpandDetected patterns
- headers via /\(CloudFront\)$/i
Amazon Cloudfront (CDN) Expand
Detected patterns
- headers via /\(CloudFront\)$/i
CloudFlare (CDN) Expand
Detected patterns
- headers server /^cloudflare$/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Claim Your €1,600 free (2) Spots Available
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://ereenerall.fun/?tid=905617&utx?cb=El5BLmTQ7TJp&top=femefun.com
HTTP 302
https://us.1post4all.com/log?action=click&key=v2-1611847661090-7-3293-950803-c11e9be3-879a-49fc-83a8-628f27067d16&ts=1611847661089&strategy=950803&ts=1611847661090 HTTP 302
https://first.camptrck.com/d4ba2e9f-6798-4cd6-8c4c-5a42f14b8e7f?pubid=7e8b430adcae5d6ac0f411155a99c052&siteid=28dddc59cbae045ec019f2798ae7a255&sitesectionid=9d56a1b8b926f361c4e0e86624a83874&sublistid=3293&creativeid=1985633&modif=1&cost=0.0122&campaignid=2028171&usfre=yes HTTP 302
https://www.nltopoffers.com/ntsskg/nl/index-uni.html?cep=cL6alnK8Dzhp3akeQZf9RaZ84p9bre91uEnmPDCmgMumZIJNWn1CZqiBoxwIl-EByc1gDMJksqiy7AdB-AHDXJMTBkWeaMxVyQ5mBIvqpQYlK_RDlxPlW7_p4wvRMZlCMjY8V9WdDsbceEMbQX5SKlPZ5SZyXQCUSdjd7BbiPskaDD0NvbZYaclfo0br3_JSdBuPGeiwVmEll8xs17h5FMYTT45yRfNxtlgtjI5ByB_HWYXR1YRbLmjCDQw1cIaVDofVvufzRU33ELSItCOH5tFsKyyp2cBpE0gxw83hFv6e3sDaMpFNjmcbzOujRQArU0vFvpQ3ZHzQUeO_WY1nlsEfVLeqjVea9aARRBimRgpY0lwmnKeiv6-IeGIvalI_p_IKXszjCCvnsvM6ZE-q65EvEM2fngN8oGMcqfDSnMxfMoTieDN2I1wwiNMGYCEiExVOCgcBDKB1-kHhJN4krbZvkRcm7un6c6KoF6Y_6cBz7uKR3SMp-qBj5T2h9vVj1dqFi9hUar8rG7IkLU3fxzl58QFZF560-R5FUJj0LIN4xkUhs9KQpUJNI8EsofBd&lptoken=1632112a841694a862f8&pubid=7e8b430adcae5d6ac0f411155a99c052&siteid=28dddc59cbae045ec019f2798ae7a255&sitesectionid=9d56a1b8b926f361c4e0e86624a83874&sublistid=3293&creativeid=1985633&modif=1&cost=0.0122&campaignid=2028171&usfre=yes Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
index-uni.html
www.nltopoffers.com/ntsskg/nl/ Redirect Chain
|
37 KB 18 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
www.nltopoffers.com/ntsskg/nl/ |
10 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
EU.png
www.nltopoffers.com/ntsskg/nl/images/ |
589 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
slot-start.png
www.nltopoffers.com/ntsskg/nl/images/ |
25 KB 26 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
slot-spin.gif
www.nltopoffers.com/ntsskg/nl/images/ |
86 KB 86 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
slot-result-1.png
www.nltopoffers.com/ntsskg/nl/images/ |
20 KB 20 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
slot-result-2.png
www.nltopoffers.com/ntsskg/nl/images/ |
26 KB 27 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
slot-win.png
www.nltopoffers.com/ntsskg/nl/images/ |
14 KB 15 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
red-arrow-left.png
www.nltopoffers.com/ntsskg/nl/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
red-arrow-right.png
www.nltopoffers.com/ntsskg/nl/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.0/ |
84 KB 29 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
alert.ogg
www.nltopoffers.com/ntsskg/nl/ |
6 KB 6 KB |
Media
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
win.mp3
www.nltopoffers.com/ntsskg/nl/sounds/ |
10 KB 11 KB |
Media
audio/mpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
spin.mp3
www.nltopoffers.com/ntsskg/nl/sounds/ |
9 KB 9 KB |
Media
audio/mpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
arrow.png
www.nltopoffers.com/ntsskg/nl/ |
154 B 641 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Google (Online)27 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery function| clickMe function| countdown number| hoursleft number| minutesleft number| secondsleft number| millisecondsleft string| finishedtext function| cd object| end object| now object| diff number| timerID string| index string| indexPrefix string| indexSuffix number| value1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.nltopoffers.com/ | Name: __cfduid Value: d55acd379b1ec7ae273e6a1b13fffb8041611847662 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
ereenerall.fun
first.camptrck.com
us.1post4all.com
www.nltopoffers.com
13.224.194.68
18.195.174.160
2606:4700:3036::ac43:ac9d
2a00:1450:4001:824::200a
38.122.162.114
26e13d692f377e570c055163dee942742e6d775f278888fc875536acc3436c89
316ffa2c31644e0ff2549d0f84ed23841572ebad1b290243679c4b4752d2bec1
4a688dc66588e8e86e98ccadb318fa2aca3fd6e2444aac783278b982f3e47eef
5351d7b058d47812c8a2c74bccef9389a11e3df9cd19874d95b7000c8ab9ea9e
635e9ee8fcd18bd4c3ae173f00f4c5cbf15ee90a27a302440e2e77c371314176
6689923da904560b6c9cff4d3687ff0aa4ec04ed538e1421faa01a03bcfd5104
6c24b85e36500836887748ab5fcfa2663bd6ab39d28f73e75aa5a669bf9386cb
7a5e8d7df9f594cb643406fcdf72c733fe1909ccb4092763004175623dfe86c9
7f8e36cf7ac437d7c42440ef5f522c8e27adb06348b573192308038fa7c1dc7e
879bd0f30ace2e268eede07e3d9c8cf2a7d4719a91c7e480f6b66795e3f0aaed
8a102873a33f24f7eb22221e6b23c4f718e29f85168ecc769a35bfaed9b12cce
98da92b2ad25d0d5da1132b4c3d348a71ad1610887009dee10bf8ec86a5b9c02
9b8fa3d6ccb98804102ffd59ee70c19e5d7ca7efabbe6c0d4471a1935348ee3d
9f8160d6380fef91c8eadecc6e8e59e93e3f5c40be7963018c8104bef4354d8f
aa05de326a8afd2a7b16c253d8c10fc41857b474f23a814ffa7684d4ef17c1a9
aea3443ffa2df4454daac365b37a61f9b9b1ba24dc0899ff3afca9f770765ce0
b09b477eb93ed896b8e52a2f746e435695dbef2a1259987bae4fbea3c35b5435
b8f1ec0ac028bd024af2cf57b63b07069b2f4a41e61c1577e968ca5d7ba72837
bf54bbb614133b29483628d122b5c4654a0a2c6134f56d699f6d7ee6d6f2a68c
c402c36eb8d623b618261d40846e63c130de1e78720ab5578eae1d645198c963
e1abb99fd254d74431481fd6026f6095123ca1f830b7415f91452157efefe981
e3da7d20be42da6e260d3085d2a3f3965a549065345ee2d139e28625104e2393
ef342fb61629c3603ca0dc0b366caedfd1914d1c8d709d9471d7b54168b0094d
efb819d37f19ec7505d9602488ce97868d84e1c7929ce83e308e23f02d97b95d
f1ec80b148a8759d0e57d91b6225dd3243a8911c2e88f109759544ebd01d7c3c
fa07d78345204bf48b255523990b544e1b28f9a7810aaf2b8a5a356d05575205