URL: https://travexgobudynons.tk/
Submission Tags: phish-stream
Submission: On October 29 via api from CA — Scanned from CA

Summary

This website contacted 7 IPs in 2 countries across 8 domains to perform 10 HTTP transactions. The main IP is 2606:4700:3035::ac43:9ba6, located in United States and belongs to CLOUDFLARENET, US. The main domain is travexgobudynons.tk.
TLS certificate: Issued by E1 on October 29th 2022. Valid for: 3 months.
This is the only time travexgobudynons.tk was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2606:4700:303... 13335 (CLOUDFLAR...)
1 2607:f8b0:400... 15169 (GOOGLE)
1 1 160.17.5.1 2497 (IIJ Inter...)
1 52.219.16.218 16509 (AMAZON-02)
1 183.181.91.58 131965 (XSERVER X...)
1 219.94.162.27 9371 (SAKURA-C ...)
2 183.90.253.24 131965 (XSERVER X...)
3 2607:f8b0:400... 15169 (GOOGLE)
10 7
Apex Domain
Subdomains
Transfer
3 gstatic.com
fonts.gstatic.com
82 KB
2 chitsu.media
chitsu.media
34 KB
1 town-meets.com
town-meets.com
166 KB
1 nikukai.jp
www.nikukai.jp
191 KB
1 amazonaws.com
s3.ap-northeast-1.amazonaws.com — Cisco Umbrella Rank: 44479
187 KB
1 jalan.net
www.jalan.net — Cisco Umbrella Rank: 388695
325 B
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 36
1 KB
1 travexgobudynons.tk
travexgobudynons.tk
22 KB
10 8
Domain Requested by
3 fonts.gstatic.com fonts.googleapis.com
2 chitsu.media travexgobudynons.tk
1 town-meets.com travexgobudynons.tk
1 www.nikukai.jp travexgobudynons.tk
1 s3.ap-northeast-1.amazonaws.com travexgobudynons.tk
1 www.jalan.net 1 redirects
1 fonts.googleapis.com travexgobudynons.tk
1 travexgobudynons.tk
10 8

This site contains no links.

Subject Issuer Validity Valid
*.travexgobudynons.tk
E1
2022-10-29 -
2023-01-27
3 months crt.sh
upload.video.google.com
GTS CA 1C3
2022-09-26 -
2022-12-19
3 months crt.sh
www.nikukai.jp
R3
2022-09-04 -
2022-12-03
3 months crt.sh
town-meets.com
R3
2022-10-03 -
2023-01-01
3 months crt.sh
www.chitsu.media
R3
2022-09-01 -
2022-11-30
3 months crt.sh
*.gstatic.com
GTS CA 1C3
2022-09-26 -
2022-12-19
3 months crt.sh

This page contains 1 frames:

Primary Page: https://travexgobudynons.tk/
Frame ID: 13C5BB468AD98A778DC7BBED5180A519
Requests: 10 HTTP requests in this frame

Screenshot

Page Title

長く続いている夫婦を参考に交際をしよう 茨城水戸結婚相談所

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

10
Requests

90 %
HTTPS

38 %
IPv6

8
Domains

8
Subdomains

7
IPs

2
Countries

682 kB
Transfer

730 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • https://www.jalan.net/news/img/2020/09/2020914_shizuoka-ame-date_03.jpg HTTP 301
  • https://s3.ap-northeast-1.amazonaws.com/magazine.jalan.net/img/2020/09/2020914_shizuoka-ame-date_03.jpg

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
travexgobudynons.tk/
59 KB
22 KB
Document
General
Full URL
https://travexgobudynons.tk/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::ac43:9ba6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ba396491a08ab4ad5947b2fd5162889a02c5bd25bf5479386b81905f5f9fd99e

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
761cda059e1d4bbe-YUL
content-encoding
br
content-type
text/html; charset=UTF-8
date
Sat, 29 Oct 2022 15:12:49 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ordj1R793GtDToQcvumMsW%2BTIUj%2Fqa40ITC%2FlOh1wqkDangzXf6yPuh5s3MgF3dajWDFLFza9OULhoqO%2BMr94uVIM4DnivMT3KmBPF8TGQHJjW%2FxkwnQs%2F087i9TgEWF2p7wzinfKI%2FZctVuy3F0emtj"}],"group":"cf-nel","max_age":604800}
server
cloudflare
css
fonts.googleapis.com/
15 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Bitter%3Aregular%2Citalic%2C700%7CPlayfair+Display%3Aregular%2Citalic%2C700%2C700italic%2C900%2C900italic%7CEB+Garamond%3Aregular
Requested by
Host: travexgobudynons.tk
URL: https://travexgobudynons.tk/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:823::200a , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
c130194b32eb689844f6a08adeb3db75ff19e65ab28e3de0e674122cc8aad02b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://travexgobudynons.tk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Sat, 29 Oct 2022 15:12:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Sat, 29 Oct 2022 15:12:49 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sat, 29 Oct 2022 15:12:49 GMT
2020914_shizuoka-ame-date_03.jpg
s3.ap-northeast-1.amazonaws.com/magazine.jalan.net/img/2020/09/
Redirect Chain
  • https://www.jalan.net/news/img/2020/09/2020914_shizuoka-ame-date_03.jpg
  • https://s3.ap-northeast-1.amazonaws.com/magazine.jalan.net/img/2020/09/2020914_shizuoka-ame-date_03.jpg
186 KB
187 KB
Image
General
Full URL
https://s3.ap-northeast-1.amazonaws.com/magazine.jalan.net/img/2020/09/2020914_shizuoka-ame-date_03.jpg
Requested by
Host: travexgobudynons.tk
URL: https://travexgobudynons.tk/
Protocol
HTTP/1.1
Server
52.219.16.218 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-ap-northeast-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
c1b258579d5ee6dcc878ba37403b448b4c309c3e0f91743992a7392c6a77e248

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://travexgobudynons.tk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Date
Sat, 29 Oct 2022 15:12:53 GMT
Last-Modified
Mon, 14 Sep 2020 10:35:21 GMT
Server
AmazonS3
x-amz-request-id
W4CJXWHNCG2N3CXS
ETag
"609e4302a5b96807cfdfe5ebdceae2a5"
Content-Type
image/jpeg
Accept-Ranges
bytes
Content-Length
190924
x-amz-id-2
6o/njjHbplDHnTdcIRtXuFSbkcIcKl4V/peIiErcrSKZBF1cMpPLpIogi087UYhsn0TDww7NUj8=

Redirect headers

Location
https://s3.ap-northeast-1.amazonaws.com/magazine.jalan.net/img/2020/09/2020914_shizuoka-ame-date_03.jpg
Date
Sat, 29 Oct 2022 15:12:51 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=65, max=100
Content-Length
311
Content-Type
text/html; charset=iso-8859-1
t665433.jpg
www.nikukai.jp/wp-content/uploads/2020/05/
191 KB
191 KB
Image
General
Full URL
https://www.nikukai.jp/wp-content/uploads/2020/05/t665433.jpg
Requested by
Host: travexgobudynons.tk
URL: https://travexgobudynons.tk/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
183.181.91.58 , Japan, ASN131965 (XSERVER Xserver Inc., JP),
Reverse DNS
sv1057.wpx.ne.jp
Software
nginx /
Resource Hash
9a17730bb520ed940879134da001f544bda656b10056f1d22f7fd7634b260d4c

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://travexgobudynons.tk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Sat, 29 Oct 2022 15:12:51 GMT
last-modified
Sat, 30 May 2020 03:29:00 GMT
server
nginx
etag
"2fa24-5a6d5299db700"
content-type
image/jpeg
cache-control
max-age=604800
accept-ranges
bytes
content-length
195108
expires
Sat, 05 Nov 2022 15:12:51 GMT
305.jpg
town-meets.com/sk/
166 KB
166 KB
Image
General
Full URL
https://town-meets.com/sk/305.jpg
Requested by
Host: travexgobudynons.tk
URL: https://travexgobudynons.tk/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
219.94.162.27 , Japan, ASN9371 (SAKURA-C SAKURA Internet Inc., JP),
Reverse DNS
www1217.sakura.ne.jp
Software
nginx /
Resource Hash
49ae92eee223c6bd807f1af555a60cb66b3f21d4834210bcb6f9097fcb2ca0dd

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://travexgobudynons.tk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Sat, 29 Oct 2022 15:12:50 GMT
last-modified
Fri, 03 Apr 2020 12:28:35 GMT
server
nginx
accept-ranges
bytes
etag
"29673-5a2620e5ca2c0"
content-length
169587
content-type
image/jpeg
28_500.jpg
chitsu.media/wp-content/uploads/
18 KB
18 KB
Image
General
Full URL
https://chitsu.media/wp-content/uploads/28_500.jpg
Requested by
Host: travexgobudynons.tk
URL: https://travexgobudynons.tk/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
183.90.253.24 , Japan, ASN131965 (XSERVER Xserver Inc., JP),
Reverse DNS
sv1423.xserver.jp
Software
nginx /
Resource Hash
0c26e700431ff40a9076f62cea5faac872eaac17582e7c729e8395a34a81977f

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://travexgobudynons.tk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma
public
date
Sat, 29 Oct 2022 15:12:51 GMT
referrer-policy
no-referrer-when-downgrade
last-modified
Mon, 28 Mar 2022 19:08:11 GMT
server
nginx
etag
"484a-5db4c088ead2c"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
18506
expires
Sun, 29 Oct 2023 15:12:51 GMT
14-1-640x485.jpg
chitsu.media/wp-content/uploads/
15 KB
15 KB
Image
General
Full URL
https://chitsu.media/wp-content/uploads/14-1-640x485.jpg
Requested by
Host: travexgobudynons.tk
URL: https://travexgobudynons.tk/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
183.90.253.24 , Japan, ASN131965 (XSERVER Xserver Inc., JP),
Reverse DNS
sv1423.xserver.jp
Software
nginx /
Resource Hash
5285dc172252adae84beb526b0fc5c292a26cc6244a6d13c1be906495a2da2e9

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://travexgobudynons.tk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma
public
date
Sat, 29 Oct 2022 15:12:51 GMT
referrer-policy
no-referrer-when-downgrade
last-modified
Thu, 20 Aug 2020 02:24:33 GMT
server
nginx
etag
"3bee-5ad45d22008f6"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
15342
expires
Sun, 29 Oct 2023 15:12:51 GMT
rax8HiqOu8IVPmn7f4xp.woff2
fonts.gstatic.com/s/bitter/v28/
30 KB
31 KB
Font
General
Full URL
https://fonts.gstatic.com/s/bitter/v28/rax8HiqOu8IVPmn7f4xp.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Bitter%3Aregular%2Citalic%2C700%7CPlayfair+Display%3Aregular%2Citalic%2C700%2C700italic%2C900%2C900italic%7CEB+Garamond%3Aregular
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:817::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c470360f2548fb327562d8ce35185a96f59ab6daeb56c0d45ab712b63de848da
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://travexgobudynons.tk
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Mon, 24 Oct 2022 22:09:22 GMT
x-content-type-options
nosniff
age
407007
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
30896
x-xss-protection
0
last-modified
Fri, 24 Jun 2022 18:46:28 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 24 Oct 2023 22:09:22 GMT
raxjHiqOu8IVPmn7epZnDMyKBvHf5D6c4Pz-X3By.woff2
fonts.gstatic.com/s/bitter/v28/
16 KB
16 KB
Font
General
Full URL
https://fonts.gstatic.com/s/bitter/v28/raxjHiqOu8IVPmn7epZnDMyKBvHf5D6c4Pz-X3By.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Bitter%3Aregular%2Citalic%2C700%7CPlayfair+Display%3Aregular%2Citalic%2C700%2C700italic%2C900%2C900italic%7CEB+Garamond%3Aregular
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:817::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5fab899ca1e6aaa0693d61d2f5793cc641b6e1cac34b5731f13a96420c6acbb8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://travexgobudynons.tk
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Fri, 28 Oct 2022 10:29:53 GMT
x-content-type-options
nosniff
age
103376
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
16316
x-xss-protection
0
last-modified
Fri, 24 Jun 2022 18:46:04 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 28 Oct 2023 10:29:53 GMT
nuFiD-vYSZviVYUb_rj3ij__anPXDTzYgA.woff2
fonts.gstatic.com/s/playfairdisplay/v30/
35 KB
35 KB
Font
General
Full URL
https://fonts.gstatic.com/s/playfairdisplay/v30/nuFiD-vYSZviVYUb_rj3ij__anPXDTzYgA.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Bitter%3Aregular%2Citalic%2C700%7CPlayfair+Display%3Aregular%2Citalic%2C700%2C700italic%2C900%2C900italic%7CEB+Garamond%3Aregular
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:817::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
22b6cdc450204c1cb32b31e679d812fea1c17ac506a7b78daeb12bd0ab25fde8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://travexgobudynons.tk
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Mon, 24 Oct 2022 21:15:59 GMT
x-content-type-options
nosniff
age
410210
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35764
x-xss-protection
0
last-modified
Mon, 18 Jul 2022 19:06:36 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 24 Oct 2023 21:15:59 GMT

Verdicts & Comments Add Verdict or Comment

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation

1 Cookies

Domain/Path Name / Value
travexgobudynons.tk/ Name: ch1c
Value: b

1 Console Messages

Source Level URL
Text
security warning URL: https://travexgobudynons.tk/(Line 206)
Message:
Mixed Content: The page at 'https://travexgobudynons.tk/' was loaded over HTTPS, but requested an insecure element 'http://town-meets.com/sk/305.jpg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html