itsawinner.xyz Open in urlscan Pro
2600:9000:2490:9400:18:83b3:ad40:93a1 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://fastweblink.com/cf152d6c-2a94-4926-b820-c050b3108b11
Effective URL:
https://itsawinner.xyz/auoptus-cash/index.html?ip=185.213.155.153&domain=fastweblink.com&cep=OA90TN-0cFqEEyHO9K1fzSY-WQ...
Submission: On April 01 via automatic, source openphish (April 1st 2023, 12:02:54 am UTC) — Scanned from DE

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 4 domains to perform 11 HTTP transactions. The main IP is 2600:9000:2490:9400:18:83b3:ad40:93a1, located in United States and belongs to AMAZON-02, US. The main domain is itsawinner.xyz.
TLS certificate: Issued by Amazon RSA 2048 M01 on March 15th 2023. Valid for: a year.

This is the only time itsawinner.xyz was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	18.156.16.63 18.156.16.63	16509 (AMAZON-02) (AMAZON-02)
7	2600:9000:249... 2600:9000:2490:9400:18:83b3:ad40:93a1	16509 (AMAZON-02) (AMAZON-02)
3	139.45.197.250 139.45.197.250	9002 (RETN-AS) (RETN-AS)
1	139.45.195.8 139.45.195.8	9002 (RETN-AS) (RETN-AS)
11	3

1 18.156.16.63 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-156-16-63.eu-central-1.compute.amazonaws.com

fastweblink.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2600:9000:2490:9400:18:83b3:ad40:93a1 (United States)

ASN16509 (AMAZON-02, US)

itsawinner.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 139.45.197.250 (United Kingdom)

ASN9002 (RETN-AS, GB)

desekansr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 139.45.195.8 (United Kingdom)

ASN9002 (RETN-AS, GB)

my.rtmark.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	itsawinner.xyz itsawinner.xyz	113 KB
3	desekansr.com desekansr.com — Cisco Umbrella Rank: 244180	16 KB
1	rtmark.net my.rtmark.net — Cisco Umbrella Rank: 10781	543 B
1	fastweblink.com 1 redirects fastweblink.com	1 KB
11	4

	Domain	Requested by
7	itsawinner.xyz	itsawinner.xyz
3	desekansr.com	itsawinner.xyz desekansr.com
1	my.rtmark.net	desekansr.com
1	fastweblink.com	1 redirects
11	4

This site contains no links.

Subject Issuer	Validity	Valid
itsawinner.xyz Amazon RSA 2048 M01	`2023-03-15` - `2024-04-12`	a year	crt.sh
desekansr.com R3	`2023-03-28` - `2023-06-26`	3 months	crt.sh
rtmark.net R3	`2023-02-15` - `2023-05-16`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://itsawinner.xyz/auoptus-cash/index.html?ip=185.213.155.153&domain=fastweblink.com&cep=OA90TN-0cFqEEyHO9K1fzSY-WQ2Kxj6zx_yyKGdKnTtD7J-ft_FaIhVoEiknRM82jtuBKHcviXOsrTDHn4DPTaaJsGtlyLNWH_uq-YjBco7YpON6wBvF5UGP3lxkCeT4yY4mAPeffjgv2KFTKwpjJLbC1rTZ-7vg0EPXNf3LxpL2zuDzYK939rIhRhf1hhK9zSJYlIT3Ip9iBKNveY7i1-Lbn6QGvc03nsNVnQ-G-iCmbDBQ_nhpEfQQjFRYP5SExeMb9H6n5LnkdfrGttHzMkVAXU8GCtLjGEZVacGy_-vrl38YumyuiTZP4hKRBRhMm_D0MhxasqZx7KoFqnxsG6z8LlF2Bq9flrFsJY_oO4g&lptoken=16ef80d230739105709a
Frame ID: BCEF8D8B18B3F2DCD2698CBC09E42958
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Optus

Page URL History Show full URLs

https://fastweblink.com/cf152d6c-2a94-4926-b820-c050b3108b11 HTTP 302
https://itsawinner.xyz/auoptus-cash/index.html?ip=185.213.155.153&domain=fastweblink.com&cep=OA90TN... Page URL

Page Statistics

11
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

3
IPs

3
Countries

129 kB
Transfer

243 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://fastweblink.com/cf152d6c-2a94-4926-b820-c050b3108b11 HTTP 302
https://itsawinner.xyz/auoptus-cash/index.html?ip=185.213.155.153&domain=fastweblink.com&cep=OA90TN-0cFqEEyHO9K1fzSY-WQ2Kxj6zx_yyKGdKnTtD7J-ft_FaIhVoEiknRM82jtuBKHcviXOsrTDHn4DPTaaJsGtlyLNWH_uq-YjBco7YpON6wBvF5UGP3lxkCeT4yY4mAPeffjgv2KFTKwpjJLbC1rTZ-7vg0EPXNf3LxpL2zuDzYK939rIhRhf1hhK9zSJYlIT3Ip9iBKNveY7i1-Lbn6QGvc03nsNVnQ-G-iCmbDBQ_nhpEfQQjFRYP5SExeMb9H6n5LnkdfrGttHzMkVAXU8GCtLjGEZVacGy_-vrl38YumyuiTZP4hKRBRhMm_D0MhxasqZx7KoFqnxsG6z8LlF2Bq9flrFsJY_oO4g&lptoken=16ef80d230739105709a Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request index.html Show response
itsawinner.xyz/auoptus-cash/
Redirect Chain

https://fastweblink.com/cf152d6c-2a94-4926-b820-c050b3108b11
https://itsawinner.xyz/auoptus-cash/index.html?ip=185.213.155.153&domain=fastweblink.com&cep=OA90TN-0cFqEEyHO9K1fzSY-WQ2Kxj6zx_yyKGdKnTtD7J-ft_FaIhVoEiknRM82jtuBKHcviXOsrTDHn4DPTaaJsGtlyLNWH_uq-YjB...

6 KB
3 KB

63ms
8ms

Document
text/html

2600:9000:2490:9400:18:83b3:ad40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://itsawinner.xyz/auoptus-cash/index.html?ip=185.213.155.153&domain=fastweblink.com&cep=OA90TN-0cFqEEyHO9K1fzSY-WQ2Kxj6zx_yyKGdKnTtD7J-ft_FaIhVoEiknRM82jtuBKHcviXOsrTDHn4DPTaaJsGtlyLNWH_uq-YjBco7YpON6wBvF5UGP3lxkCeT4yY4mAPeffjgv2KFTKwpjJLbC1rTZ-7vg0EPXNf3LxpL2zuDzYK939rIhRhf1hhK9zSJYlIT3Ip9iBKNveY7i1-Lbn6QGvc03nsNVnQ-G-iCmbDBQ_nhpEfQQjFRYP5SExeMb9H6n5LnkdfrGttHzMkVAXU8GCtLjGEZVacGy_-vrl38YumyuiTZP4hKRBRhMm_D0MhxasqZx7KoFqnxsG6z8LlF2Bq9flrFsJY_oO4g&lptoken=16ef80d230739105709a
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2490:9400:18:83b3:ad40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1270c781738b1d769be53a700e0c6b016e8af1538faa6750c7b3dc8e0d5f787f

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 37455
content-encoding: gzip
content-type: text/html
date: Fri, 31 Mar 2023 13:38:36 GMT
etag: W/"dd2bb917663510d663631c49424f6232"
last-modified: Fri, 31 Mar 2023 12:10:27 GMT
server: AmazonS3
vary: Accept-Encoding
via: 1.1 409b27093eb36cec367cdee5f3ecf8b2.cloudfront.net (CloudFront)
x-amz-cf-id: GFSRX3IYzlNNgrPzfH17jf-jwqHiR9dM06o5GvX03XmdKkVjjSYYcQ==
x-amz-cf-pop: FRA56-P6
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront

Redirect headers

cache-control: no-store, no-cache, pre-check=0, post-check=0
content-length: 0
date: Sat, 01 Apr 2023 00:02:50 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://itsawinner.xyz/auoptus-cash/index.html?ip=185.213.155.153&domain=fastweblink.com&cep=OA90TN-0cFqEEyHO9K1fzSY-WQ2Kxj6zx_yyKGdKnTtD7J-ft_FaIhVoEiknRM82jtuBKHcviXOsrTDHn4DPTaaJsGtlyLNWH_uq-YjBco7YpON6wBvF5UGP3lxkCeT4yY4mAPeffjgv2KFTKwpjJLbC1rTZ-7vg0EPXNf3LxpL2zuDzYK939rIhRhf1hhK9zSJYlIT3Ip9iBKNveY7i1-Lbn6QGvc03nsNVnQ-G-iCmbDBQ_nhpEfQQjFRYP5SExeMb9H6n5LnkdfrGttHzMkVAXU8GCtLjGEZVacGy_-vrl38YumyuiTZP4hKRBRhMm_D0MhxasqZx7KoFqnxsG6z8LlF2Bq9flrFsJY_oO4g&lptoken=16ef80d230739105709a
pragma: no-cache
server: nginx

GET
H2 200 app.css
itsawinner.xyz/auoptus-cash/css/ 309 B
662 B 9ms
8ms Stylesheet
text/css 2600:9000:2490:9400:18:83b3:ad40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://itsawinner.xyz/auoptus-cash/css/app.css?id=2b8d5309d40668bd2ba4
Requested by: Host: itsawinner.xyz
URL: https://itsawinner.xyz/auoptus-cash/index.html?ip=185.213.155.153&domain=fastweblink.com&cep=OA90TN-0cFqEEyHO9K1fzSY-WQ2Kxj6zx_yyKGdKnTtD7J-ft_FaIhVoEiknRM82jtuBKHcviXOsrTDHn4DPTaaJsGtlyLNWH_uq-YjBco7YpON6wBvF5UGP3lxkCeT4yY4mAPeffjgv2KFTKwpjJLbC1rTZ-7vg0EPXNf3LxpL2zuDzYK939rIhRhf1hhK9zSJYlIT3Ip9iBKNveY7i1-Lbn6QGvc03nsNVnQ-G-iCmbDBQ_nhpEfQQjFRYP5SExeMb9H6n5LnkdfrGttHzMkVAXU8GCtLjGEZVacGy_-vrl38YumyuiTZP4hKRBRhMm_D0MhxasqZx7KoFqnxsG6z8LlF2Bq9flrFsJY_oO4g&lptoken=16ef80d230739105709a
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2490:9400:18:83b3:ad40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b894064a5e464372c66d036df3a577a8d9a4e927c47f16a02c036d8625eb3ca3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://itsawinner.xyz/auoptus-cash/index.html?ip=185.213.155.153&domain=fastweblink.com&cep=OA90TN-0cFqEEyHO9K1fzSY-WQ2Kxj6zx_yyKGdKnTtD7J-ft_FaIhVoEiknRM82jtuBKHcviXOsrTDHn4DPTaaJsGtlyLNWH_uq-YjBco7YpON6wBvF5UGP3lxkCeT4yY4mAPeffjgv2KFTKwpjJLbC1rTZ-7vg0EPXNf3LxpL2zuDzYK939rIhRhf1hhK9zSJYlIT3Ip9iBKNveY7i1-Lbn6QGvc03nsNVnQ-G-iCmbDBQ_nhpEfQQjFRYP5SExeMb9H6n5LnkdfrGttHzMkVAXU8GCtLjGEZVacGy_-vrl38YumyuiTZP4hKRBRhMm_D0MhxasqZx7KoFqnxsG6z8LlF2Bq9flrFsJY_oO4g&lptoken=16ef80d230739105709a
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 31 Mar 2023 14:55:32 GMT
via: 1.1 409b27093eb36cec367cdee5f3ecf8b2.cloudfront.net (CloudFront)
last-modified: Fri, 31 Mar 2023 12:10:27 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P6
age: 32839
etag: "2b8d5309d40668bd2ba4b65a45a635a4"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: text/css
accept-ranges: bytes
content-length: 309
x-amz-cf-id: 5yR7h-EgVinAPkX8vJOkNic9eIzjGcADoz_mmgOyzafMs5xcJgO7ZQ==

GET
H2 200 app.css
itsawinner.xyz/auoptus-cash/css/landers/survey/ 3 KB
1 KB 10ms
9ms Stylesheet
text/css 2600:9000:2490:9400:18:83b3:ad40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://itsawinner.xyz/auoptus-cash/css/landers/survey/app.css?id=3dea3cc428f109709a1b
Requested by: Host: itsawinner.xyz
URL: https://itsawinner.xyz/auoptus-cash/index.html?ip=185.213.155.153&domain=fastweblink.com&cep=OA90TN-0cFqEEyHO9K1fzSY-WQ2Kxj6zx_yyKGdKnTtD7J-ft_FaIhVoEiknRM82jtuBKHcviXOsrTDHn4DPTaaJsGtlyLNWH_uq-YjBco7YpON6wBvF5UGP3lxkCeT4yY4mAPeffjgv2KFTKwpjJLbC1rTZ-7vg0EPXNf3LxpL2zuDzYK939rIhRhf1hhK9zSJYlIT3Ip9iBKNveY7i1-Lbn6QGvc03nsNVnQ-G-iCmbDBQ_nhpEfQQjFRYP5SExeMb9H6n5LnkdfrGttHzMkVAXU8GCtLjGEZVacGy_-vrl38YumyuiTZP4hKRBRhMm_D0MhxasqZx7KoFqnxsG6z8LlF2Bq9flrFsJY_oO4g&lptoken=16ef80d230739105709a
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2490:9400:18:83b3:ad40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2849b08042bdb384397e10b2900a42290c4e15927fca5766797e032e179dfbf1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://itsawinner.xyz/auoptus-cash/index.html?ip=185.213.155.153&domain=fastweblink.com&cep=OA90TN-0cFqEEyHO9K1fzSY-WQ2Kxj6zx_yyKGdKnTtD7J-ft_FaIhVoEiknRM82jtuBKHcviXOsrTDHn4DPTaaJsGtlyLNWH_uq-YjBco7YpON6wBvF5UGP3lxkCeT4yY4mAPeffjgv2KFTKwpjJLbC1rTZ-7vg0EPXNf3LxpL2zuDzYK939rIhRhf1hhK9zSJYlIT3Ip9iBKNveY7i1-Lbn6QGvc03nsNVnQ-G-iCmbDBQ_nhpEfQQjFRYP5SExeMb9H6n5LnkdfrGttHzMkVAXU8GCtLjGEZVacGy_-vrl38YumyuiTZP4hKRBRhMm_D0MhxasqZx7KoFqnxsG6z8LlF2Bq9flrFsJY_oO4g&lptoken=16ef80d230739105709a
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 31 Mar 2023 13:36:42 GMT
content-encoding: br
via: 1.1 409b27093eb36cec367cdee5f3ecf8b2.cloudfront.net (CloudFront)
last-modified: Fri, 31 Mar 2023 12:10:27 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P6
age: 37568
etag: W/"8b6b5a6ad1ff6cc40005f6c84a3e1438"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
x-amz-cf-id: 8avxl1YwhxhAw9TKN22V7kAwZkXd981AjR_u-7x2-wTr5y35oVMXaw==

GET
H2 200 entel.png
itsawinner.xyz/auoptus-cash/img/landers/survey/ 9 KB
10 KB 13ms
13ms Image
image/png 2600:9000:2490:9400:18:83b3:ad40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://itsawinner.xyz/auoptus-cash/img/landers/survey/entel.png
Requested by: Host: itsawinner.xyz
URL: https://itsawinner.xyz/auoptus-cash/index.html?ip=185.213.155.153&domain=fastweblink.com&cep=OA90TN-0cFqEEyHO9K1fzSY-WQ2Kxj6zx_yyKGdKnTtD7J-ft_FaIhVoEiknRM82jtuBKHcviXOsrTDHn4DPTaaJsGtlyLNWH_uq-YjBco7YpON6wBvF5UGP3lxkCeT4yY4mAPeffjgv2KFTKwpjJLbC1rTZ-7vg0EPXNf3LxpL2zuDzYK939rIhRhf1hhK9zSJYlIT3Ip9iBKNveY7i1-Lbn6QGvc03nsNVnQ-G-iCmbDBQ_nhpEfQQjFRYP5SExeMb9H6n5LnkdfrGttHzMkVAXU8GCtLjGEZVacGy_-vrl38YumyuiTZP4hKRBRhMm_D0MhxasqZx7KoFqnxsG6z8LlF2Bq9flrFsJY_oO4g&lptoken=16ef80d230739105709a
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2490:9400:18:83b3:ad40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d7b505888328310fc769cdb36add55a8541d6d4c43e2ec72a03e18f8ee88af35

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://itsawinner.xyz/auoptus-cash/index.html?ip=185.213.155.153&domain=fastweblink.com&cep=OA90TN-0cFqEEyHO9K1fzSY-WQ2Kxj6zx_yyKGdKnTtD7J-ft_FaIhVoEiknRM82jtuBKHcviXOsrTDHn4DPTaaJsGtlyLNWH_uq-YjBco7YpON6wBvF5UGP3lxkCeT4yY4mAPeffjgv2KFTKwpjJLbC1rTZ-7vg0EPXNf3LxpL2zuDzYK939rIhRhf1hhK9zSJYlIT3Ip9iBKNveY7i1-Lbn6QGvc03nsNVnQ-G-iCmbDBQ_nhpEfQQjFRYP5SExeMb9H6n5LnkdfrGttHzMkVAXU8GCtLjGEZVacGy_-vrl38YumyuiTZP4hKRBRhMm_D0MhxasqZx7KoFqnxsG6z8LlF2Bq9flrFsJY_oO4g&lptoken=16ef80d230739105709a
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 31 Mar 2023 14:55:33 GMT
via: 1.1 409b27093eb36cec367cdee5f3ecf8b2.cloudfront.net (CloudFront)
last-modified: Fri, 31 Mar 2023 12:10:27 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P6
age: 32838
etag: "74a3e3d3d0b5b3f6c420f14bdf2767fa"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 9690
x-amz-cf-id: uRllUTEAaZXUwA0gp_JFjfnsIk1xSlyUsJgAkL5pGz5ivDHEg-1Xkw==

GET
H2 200 default@0.25x.png
itsawinner.xyz/auoptus-cash/img/prizes/iphone-11-pro/ 56 KB
56 KB 14ms
13ms Image
image/png 2600:9000:2490:9400:18:83b3:ad40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://itsawinner.xyz/auoptus-cash/img/prizes/iphone-11-pro/default@0.25x.png
Requested by: Host: itsawinner.xyz
URL: https://itsawinner.xyz/auoptus-cash/index.html?ip=185.213.155.153&domain=fastweblink.com&cep=OA90TN-0cFqEEyHO9K1fzSY-WQ2Kxj6zx_yyKGdKnTtD7J-ft_FaIhVoEiknRM82jtuBKHcviXOsrTDHn4DPTaaJsGtlyLNWH_uq-YjBco7YpON6wBvF5UGP3lxkCeT4yY4mAPeffjgv2KFTKwpjJLbC1rTZ-7vg0EPXNf3LxpL2zuDzYK939rIhRhf1hhK9zSJYlIT3Ip9iBKNveY7i1-Lbn6QGvc03nsNVnQ-G-iCmbDBQ_nhpEfQQjFRYP5SExeMb9H6n5LnkdfrGttHzMkVAXU8GCtLjGEZVacGy_-vrl38YumyuiTZP4hKRBRhMm_D0MhxasqZx7KoFqnxsG6z8LlF2Bq9flrFsJY_oO4g&lptoken=16ef80d230739105709a
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2490:9400:18:83b3:ad40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d034658713c51249da3df464698f4ed59cf58e569c7145cc3fd3fcba97da35b5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://itsawinner.xyz/auoptus-cash/index.html?ip=185.213.155.153&domain=fastweblink.com&cep=OA90TN-0cFqEEyHO9K1fzSY-WQ2Kxj6zx_yyKGdKnTtD7J-ft_FaIhVoEiknRM82jtuBKHcviXOsrTDHn4DPTaaJsGtlyLNWH_uq-YjBco7YpON6wBvF5UGP3lxkCeT4yY4mAPeffjgv2KFTKwpjJLbC1rTZ-7vg0EPXNf3LxpL2zuDzYK939rIhRhf1hhK9zSJYlIT3Ip9iBKNveY7i1-Lbn6QGvc03nsNVnQ-G-iCmbDBQ_nhpEfQQjFRYP5SExeMb9H6n5LnkdfrGttHzMkVAXU8GCtLjGEZVacGy_-vrl38YumyuiTZP4hKRBRhMm_D0MhxasqZx7KoFqnxsG6z8LlF2Bq9flrFsJY_oO4g&lptoken=16ef80d230739105709a
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 31 Mar 2023 14:55:33 GMT
via: 1.1 409b27093eb36cec367cdee5f3ecf8b2.cloudfront.net (CloudFront)
last-modified: Fri, 31 Mar 2023 12:10:27 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P6
age: 32838
etag: "c589b66a6454cd93cd62674046d45847"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 57133
x-amz-cf-id: ZE_P30U-dIdqd5pdUpr3-7R9MYOQJ_lNbngMFo0TNec01pcna9E-ug==

GET
H2 200 app.js Show response
itsawinner.xyz/auoptus-cash/js/ 1 KB
1006 B 8ms
8ms Script
application/javascript 2600:9000:2490:9400:18:83b3:ad40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://itsawinner.xyz/auoptus-cash/js/app.js?id=f9380415e1fafc78cfc9
Requested by: Host: itsawinner.xyz
URL: https://itsawinner.xyz/auoptus-cash/index.html?ip=185.213.155.153&domain=fastweblink.com&cep=OA90TN-0cFqEEyHO9K1fzSY-WQ2Kxj6zx_yyKGdKnTtD7J-ft_FaIhVoEiknRM82jtuBKHcviXOsrTDHn4DPTaaJsGtlyLNWH_uq-YjBco7YpON6wBvF5UGP3lxkCeT4yY4mAPeffjgv2KFTKwpjJLbC1rTZ-7vg0EPXNf3LxpL2zuDzYK939rIhRhf1hhK9zSJYlIT3Ip9iBKNveY7i1-Lbn6QGvc03nsNVnQ-G-iCmbDBQ_nhpEfQQjFRYP5SExeMb9H6n5LnkdfrGttHzMkVAXU8GCtLjGEZVacGy_-vrl38YumyuiTZP4hKRBRhMm_D0MhxasqZx7KoFqnxsG6z8LlF2Bq9flrFsJY_oO4g&lptoken=16ef80d230739105709a
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2490:9400:18:83b3:ad40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a72d96732d7e4cd461456f7d199093f4dabd7e2e67ade896c8b787ce6bbceb88

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://itsawinner.xyz/auoptus-cash/index.html?ip=185.213.155.153&domain=fastweblink.com&cep=OA90TN-0cFqEEyHO9K1fzSY-WQ2Kxj6zx_yyKGdKnTtD7J-ft_FaIhVoEiknRM82jtuBKHcviXOsrTDHn4DPTaaJsGtlyLNWH_uq-YjBco7YpON6wBvF5UGP3lxkCeT4yY4mAPeffjgv2KFTKwpjJLbC1rTZ-7vg0EPXNf3LxpL2zuDzYK939rIhRhf1hhK9zSJYlIT3Ip9iBKNveY7i1-Lbn6QGvc03nsNVnQ-G-iCmbDBQ_nhpEfQQjFRYP5SExeMb9H6n5LnkdfrGttHzMkVAXU8GCtLjGEZVacGy_-vrl38YumyuiTZP4hKRBRhMm_D0MhxasqZx7KoFqnxsG6z8LlF2Bq9flrFsJY_oO4g&lptoken=16ef80d230739105709a
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 31 Mar 2023 13:36:44 GMT
content-encoding: br
via: 1.1 409b27093eb36cec367cdee5f3ecf8b2.cloudfront.net (CloudFront)
last-modified: Fri, 31 Mar 2023 12:10:27 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P6
age: 37567
etag: W/"f9380415e1fafc78cfc942998f59598f"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: G0Ql1En6ooo22XarmiZO2gjC4_SDiK1VPApxJaTrthHFwzOndtY5Qg==

GET
H2 200 app.js Show response
itsawinner.xyz/auoptus-cash/js/landers/survey/ 126 KB
41 KB 9ms
9ms Script
application/javascript 2600:9000:2490:9400:18:83b3:ad40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://itsawinner.xyz/auoptus-cash/js/landers/survey/app.js?id=a2e44b85ce440753c01a
Requested by: Host: itsawinner.xyz
URL: https://itsawinner.xyz/auoptus-cash/index.html?ip=185.213.155.153&domain=fastweblink.com&cep=OA90TN-0cFqEEyHO9K1fzSY-WQ2Kxj6zx_yyKGdKnTtD7J-ft_FaIhVoEiknRM82jtuBKHcviXOsrTDHn4DPTaaJsGtlyLNWH_uq-YjBco7YpON6wBvF5UGP3lxkCeT4yY4mAPeffjgv2KFTKwpjJLbC1rTZ-7vg0EPXNf3LxpL2zuDzYK939rIhRhf1hhK9zSJYlIT3Ip9iBKNveY7i1-Lbn6QGvc03nsNVnQ-G-iCmbDBQ_nhpEfQQjFRYP5SExeMb9H6n5LnkdfrGttHzMkVAXU8GCtLjGEZVacGy_-vrl38YumyuiTZP4hKRBRhMm_D0MhxasqZx7KoFqnxsG6z8LlF2Bq9flrFsJY_oO4g&lptoken=16ef80d230739105709a
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2490:9400:18:83b3:ad40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6d294517ca91770f6c51e83c4a2597f89ee9c4ca3cd64377dabead42d266d69f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://itsawinner.xyz/auoptus-cash/index.html?ip=185.213.155.153&domain=fastweblink.com&cep=OA90TN-0cFqEEyHO9K1fzSY-WQ2Kxj6zx_yyKGdKnTtD7J-ft_FaIhVoEiknRM82jtuBKHcviXOsrTDHn4DPTaaJsGtlyLNWH_uq-YjBco7YpON6wBvF5UGP3lxkCeT4yY4mAPeffjgv2KFTKwpjJLbC1rTZ-7vg0EPXNf3LxpL2zuDzYK939rIhRhf1hhK9zSJYlIT3Ip9iBKNveY7i1-Lbn6QGvc03nsNVnQ-G-iCmbDBQ_nhpEfQQjFRYP5SExeMb9H6n5LnkdfrGttHzMkVAXU8GCtLjGEZVacGy_-vrl38YumyuiTZP4hKRBRhMm_D0MhxasqZx7KoFqnxsG6z8LlF2Bq9flrFsJY_oO4g&lptoken=16ef80d230739105709a
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 31 Mar 2023 13:36:44 GMT
content-encoding: br
via: 1.1 409b27093eb36cec367cdee5f3ecf8b2.cloudfront.net (CloudFront)
last-modified: Fri, 31 Mar 2023 12:10:28 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P6
age: 37567
etag: W/"a2e44b85ce440753c01a2da1238d16e6"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: IInsTue4y3XMD2jc382bkFl38NvqSVwT-c3Q0HrQAKHzW-UgimI5uQ==

GET
H2 200 micro.tag.min.js Show response
desekansr.com/pfe/current/ 40 KB
14 KB 76ms
23ms Script
application/javascript 139.45.197.250
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://desekansr.com/pfe/current/micro.tag.min.js?z=5378963&sw=/sw-check-permissions-f40a4.js
Requested by: Host: itsawinner.xyz
URL: https://itsawinner.xyz/auoptus-cash/index.html?ip=185.213.155.153&domain=fastweblink.com&cep=OA90TN-0cFqEEyHO9K1fzSY-WQ2Kxj6zx_yyKGdKnTtD7J-ft_FaIhVoEiknRM82jtuBKHcviXOsrTDHn4DPTaaJsGtlyLNWH_uq-YjBco7YpON6wBvF5UGP3lxkCeT4yY4mAPeffjgv2KFTKwpjJLbC1rTZ-7vg0EPXNf3LxpL2zuDzYK939rIhRhf1hhK9zSJYlIT3Ip9iBKNveY7i1-Lbn6QGvc03nsNVnQ-G-iCmbDBQ_nhpEfQQjFRYP5SExeMb9H6n5LnkdfrGttHzMkVAXU8GCtLjGEZVacGy_-vrl38YumyuiTZP4hKRBRhMm_D0MhxasqZx7KoFqnxsG6z8LlF2Bq9flrFsJY_oO4g&lptoken=16ef80d230739105709a
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 139.45.197.250 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: nginx /
Resource Hash: 8f49474e7e523ffdca14d8bc07090261bd0c794d614edad2207f4b68e4de02e5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://itsawinner.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 01 Apr 2023 00:02:50 GMT
content-encoding: gzip
last-modified: Fri, 31 Mar 2023 12:18:43 GMT
server: nginx
etag: W/"6426cfa3-a164"
content-type: application/javascript
cache-control: no-cache
access-control-allow-credentials: true

POST
H2 200 zone
desekansr.com/ 0
251 B 13ms
13ms Ping
text/plain 139.45.197.250
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://desekansr.com/zone?&pub=0&zone_id=5378963&is_mobile=false&domain=itsawinner.xyz&var=&ymid=&var_3=&var_4=&dsig=&action=prerequest

Requested by

Host: desekansr.com
URL: https://desekansr.com/pfe/current/micro.tag.min.js?z=5378963&sw=/sw-check-permissions-f40a4.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

139.45.197.250 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://itsawinner.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-trace-id: 81f7bad8909691b3f315eb89e6387bda
date: Sat, 01 Apr 2023 00:02:50 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
server: nginx
access-control-allow-origin: https://itsawinner.xyz
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
content-length: 0

GET
H2 200 gid.js Show response
my.rtmark.net/ 65 B
543 B 49ms
14ms Fetch
application/json 139.45.195.8
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://my.rtmark.net/gid.js?pub=0&userId=&zoneId=5378963&checkDuplicate=true&ymid=&var=

Requested by

Host: desekansr.com
URL: https://desekansr.com/pfe/current/micro.tag.min.js?z=5378963&sw=/sw-check-permissions-f40a4.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

ba21476252b82653bf7f04a5c28fd183b3095dd0dea1fbbcc77e4a292e524c74

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://itsawinner.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Sat, 01 Apr 2023 00:02:50 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
server: nginx
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://itsawinner.xyz
access-control-expose-headers: Authorization
access-control-allow-credentials: true
timing-allow-origin: *, *
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length: 65

GET
H2 200 zone Show response
desekansr.com/ 939 B
1 KB 38ms
13ms Fetch
application/json 139.45.197.250
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://desekansr.com/zone?&pub=0&zone_id=5378963&is_mobile=false&domain=itsawinner.xyz&var=&ymid=&var_3=&var_4=&dsig=&action=settings

Requested by

Host: desekansr.com
URL: https://desekansr.com/pfe/current/micro.tag.min.js?z=5378963&sw=/sw-check-permissions-f40a4.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

139.45.197.250 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

6ebca58f6db6227b9424a29835ec435acdde254f07d8e272322bb2ce4fe56618

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://itsawinner.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-trace-id: 26b31791dc647c3bbe18b2d3f92c69df
date: Sat, 01 Apr 2023 00:02:50 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
server: nginx
content-type: application/json; charset=utf-8
access-control-allow-origin: https://itsawinner.xyz
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
content-length: 939

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.fastweblink.com/	1970-01-20 10:46:33	Name: cf152d6c-2a94-4926-b820-c050b3108b11-v4 Value: ZgQRvrZhEP89SVdL24b2zQ-gnTsfmp4di-Ha8j2qtGY
.fastweblink.com/	1970-01-20 10:46:33	Name: cep-v4 Value: bi-7VWQ0mWziMakINwnxOJFGGrR8gggcBnIcjd9ONLifvFB9pjL_cfR6KokBRiw7TpxO3tagu2G1F9JIa26ZSv9IzDT23M0lad5AVeAHT-7_-l-q9pdWfAuCxPCqeBGeA4bK2dqFDi1HfeayEMmV5AxUUoOociRhkFPazWIhkXXiHJWlhC3xezhrBCMiQNAVw7Gc9cPi_kE7MS9HbzAIAyYzSJ1XKkiYF0rAvBy3wnx8x630Gei3mzuQEykByP8iBdn6VKbcKSz3h61mks5wGc8CF5gqpTxIRArsDyjzclX1eEbo-7DKeugHilU4t7-hlog_WsWJE51XxpxO0oPjFyHGjntRX31oFBn6RbjpghA
my.rtmark.net/	1970-01-20 19:30:43	Name: ID Value: c1decd16c08f40bb9427eade2a8a7450

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

desekansr.com
fastweblink.com
itsawinner.xyz
my.rtmark.net
139.45.195.8
139.45.197.250
18.156.16.63
2600:9000:2490:9400:18:83b3:ad40:93a1
1270c781738b1d769be53a700e0c6b016e8af1538faa6750c7b3dc8e0d5f787f
2849b08042bdb384397e10b2900a42290c4e15927fca5766797e032e179dfbf1
6d294517ca91770f6c51e83c4a2597f89ee9c4ca3cd64377dabead42d266d69f
6ebca58f6db6227b9424a29835ec435acdde254f07d8e272322bb2ce4fe56618
8f49474e7e523ffdca14d8bc07090261bd0c794d614edad2207f4b68e4de02e5
a72d96732d7e4cd461456f7d199093f4dabd7e2e67ade896c8b787ce6bbceb88
b894064a5e464372c66d036df3a577a8d9a4e927c47f16a02c036d8625eb3ca3
ba21476252b82653bf7f04a5c28fd183b3095dd0dea1fbbcc77e4a292e524c74
d034658713c51249da3df464698f4ed59cf58e569c7145cc3fd3fcba97da35b5
d7b505888328310fc769cdb36add55a8541d6d4c43e2ec72a03e18f8ee88af35
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

itsawinner.xyz Open in urlscan Pro 2600:9000:2490:9400:18:83b3:ad40:93a1 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

11 Requests

100 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

3 IPs

3 Countries

129 kBTransfer

243 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

3 Cookies

Indicators

itsawinner.xyz Open in urlscan Pro
2600:9000:2490:9400:18:83b3:ad40:93a1 Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

3
IPs

3
Countries

129 kB
Transfer

243 kB
Size

3
Cookies

11 HTTP transactions
0 data transactions