urlscan.io logo urlscan.io
SecurityTrails logo

rainbowimportexports.com Open in urlscan Pro
2606:4700:30::681b:9714  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://rainbowimportexports.com/exx/1kkw5sac6a0qwqea5cbrzv0m.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&em...
Submission: On May 02 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 12 HTTP transactions. The main IP is 2606:4700:30::681b:9714, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is rainbowimportexports.com.
TLS certificate: Issued by COMODO ECC Domain Validation Secure S... on April 26th 2019. Valid for: 6 months.
This is the only time rainbowimportexports.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Sharepoint (Online) Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
7 2606:4700:30:... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
12 5
Domain Requested by
7 rainbowimportexports.com rainbowimportexports.com
2 www.google-analytics.com www.googletagmanager.com
rainbowimportexports.com
2 fonts.googleapis.com rainbowimportexports.com
1 www.googletagmanager.com rainbowimportexports.com
12 4

This site contains no links.

Subject Issuer Validity Valid
sni111877.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2		 2019-04-26 -
2019-11-02		 6 months crt.sh
*.googleapis.com
Google Internet Authority G3		 2019-04-16 -
2019-07-09		 3 months crt.sh
*.google-analytics.com
Google Internet Authority G3		 2019-04-16 -
2019-07-09		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://rainbowimportexports.com/exx/1kkw5sac6a0qwqea5cbrzv0m.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
Frame ID: 5E568137B7EDF7CB0D3DE00E2DDA6F9A
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i
Overall confidence: 100%
Detected patterns
  • headers server /cloudflare/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
  • env /^gaGlobal$/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Overall confidence: 100%
Detected patterns
  • env /^google_tag_manager$/i

Page Statistics

12
Requests

100 %
HTTPS

100 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

73 kB
Transfer

155 kB
Size

4
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request 1kkw5sac6a0qwqea5cbrzv0m.php
rainbowimportexports.com/exx/ 		5 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://rainbowimportexports.com/exx/1kkw5sac6a0qwqea5cbrzv0m.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681b:9714 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
adf823665c20652b45dd983934aa5547063e65d38d964405a7c8fcb49e4e8501

Request headers

:method
GET
:authority
rainbowimportexports.com
:scheme
https
:path
/exx/1kkw5sac6a0qwqea5cbrzv0m.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
date
Thu, 02 May 2019 18:10:03 GMT
content-type
text/html; charset=UTF-8
set-cookie
__cfduid=d80e6251035f1efb40a9021a961be9ecd1556820602; expires=Fri, 01-May-20 18:10:02 GMT; path=/; domain=.rainbowimportexports.com; HttpOnly; Secure
cache-control
max-age=2592000
expires
Sat, 01 Jun 2019 18:10:03 GMT
vary
Accept-Encoding,User-Agent
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
4d0bf31f6ae5bece-FRA
content-encoding
br
mMu6RHcqOH9oQszpBNncBL37_Ow.js
rainbowimportexports.com/cdn-cgi/apps/head/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rainbowimportexports.com/cdn-cgi/apps/head/mMu6RHcqOH9oQszpBNncBL37_Ow.js
Requested by
Host: rainbowimportexports.com
URL: https://rainbowimportexports.com/exx/1kkw5sac6a0qwqea5cbrzv0m.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681b:9714 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
33a2ec0c5736a9131975dd5306b4360901a43a737c5e018d654e884201a7140e

Request headers

Referer
https://rainbowimportexports.com/exx/1kkw5sac6a0qwqea5cbrzv0m.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 02 May 2019 18:10:03 GMT
content-encoding
br
cf-cache-status
MISS
x-amz-request-id
BC62107F3556A04A
cf-ray
4d0bf322bf2ebece-FRA
status
200
x-amz-id-2
QjzSjY2F1lETDZhfSYTRdSyNMR4zbu8/lZ+zCSUyDUYXEm1YwZr2QuVZmPXxtkWq7Fop0CdHQBY=
last-modified
Fri, 29 Jun 2018 13:30:07 GMT
server
cloudflare
etag
W/"235df267a18879ca8a02ed5f2ab083cc"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-version-id
pREffKnlbWfS5hZWK_y9LZaznopCMAUI
cache-control
public, max-age=31536000
content-type
application/javascript; charset=utf-8
expires
Fri, 01 May 2020 18:10:03 GMT
css
fonts.googleapis.com/ 		2 KB
615 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:600
Requested by
Host: rainbowimportexports.com
URL: https://rainbowimportexports.com/exx/1kkw5sac6a0qwqea5cbrzv0m.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
0f053e63258c79fdeb028177f528b7789b9c03b1323def7bce2ce952ca1d51cb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://rainbowimportexports.com/exx/1kkw5sac6a0qwqea5cbrzv0m.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Thu, 02 May 2019 18:10:03 GMT
server
ESF
access-control-allow-origin
*
date
Thu, 02 May 2019 18:10:03 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
status
200
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection
0
expires
Thu, 02 May 2019 18:10:03 GMT
share-point.css
rainbowimportexports.com/exx/css/ 		15 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://rainbowimportexports.com/exx/css/share-point.css
Requested by
Host: rainbowimportexports.com
URL: https://rainbowimportexports.com/exx/1kkw5sac6a0qwqea5cbrzv0m.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681b:9714 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2ee69aef3afb10b368bde9fea7e97cc75c030c890e3d2b8dc4ad19d498234dbf

Request headers

Referer
https://rainbowimportexports.com/exx/1kkw5sac6a0qwqea5cbrzv0m.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 02 May 2019 18:10:03 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Sun, 31 Dec 2017 18:22:34 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding,User-Agent
content-type
text/css
status
200
cache-control
public, max-age=2678400
cf-ray
4d0bf322bf33bece-FRA
expires
Sun, 02 Jun 2019 18:10:03 GMT
logo.png
rainbowimportexports.com/exx/img/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rainbowimportexports.com/exx/img/logo.png
Requested by
Host: rainbowimportexports.com
URL: https://rainbowimportexports.com/exx/1kkw5sac6a0qwqea5cbrzv0m.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681b:9714 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
825de044d5ac6442a094ff95099f9f67e9249a8110a2fbd57128285776632adb

Request headers

Referer
https://rainbowimportexports.com/exx/1kkw5sac6a0qwqea5cbrzv0m.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 02 May 2019 18:10:03 GMT
cf-cache-status
MISS
last-modified
Sun, 31 Dec 2017 11:39:06 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=2678400
accept-ranges
bytes
cf-ray
4d0bf322bf3dbece-FRA
content-length
3331
expires
Sun, 02 Jun 2019 18:10:03 GMT
pdf.png
rainbowimportexports.com/exx/img/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rainbowimportexports.com/exx/img/pdf.png
Requested by
Host: rainbowimportexports.com
URL: https://rainbowimportexports.com/exx/1kkw5sac6a0qwqea5cbrzv0m.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681b:9714 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
db307fcef7f95139689007d7a623b340ec21282bd421c4e4b2ba09078f230545

Request headers

Referer
https://rainbowimportexports.com/exx/1kkw5sac6a0qwqea5cbrzv0m.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 02 May 2019 18:10:03 GMT
cf-cache-status
MISS
last-modified
Sun, 31 Dec 2017 12:33:24 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=2678400
accept-ranges
bytes
cf-ray
4d0bf322bf3fbece-FRA
content-length
6830
expires
Sun, 02 Jun 2019 18:10:03 GMT
logo_strip.png
rainbowimportexports.com/exx/img/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rainbowimportexports.com/exx/img/logo_strip.png
Requested by
Host: rainbowimportexports.com
URL: https://rainbowimportexports.com/exx/1kkw5sac6a0qwqea5cbrzv0m.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681b:9714 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d1f126b54d456b3d15be32e56fa230cb8a9d4b5b3cfa8e0e2b0386431c869fba

Request headers

Referer
https://rainbowimportexports.com/exx/1kkw5sac6a0qwqea5cbrzv0m.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 02 May 2019 18:10:04 GMT
cf-cache-status
HIT
last-modified
Sun, 06 May 2018 06:13:04 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=2678400
accept-ranges
bytes
cf-ray
4d0bf3253ae5bece-FRA
content-length
7541
expires
Sun, 02 Jun 2019 18:10:04 GMT
email-decode.min.js
rainbowimportexports.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 		1 KB
833 B 		Script
General
Check archive.org
Download Go to
Full URL
https://rainbowimportexports.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: rainbowimportexports.com
URL: https://rainbowimportexports.com/exx/1kkw5sac6a0qwqea5cbrzv0m.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681b:9714 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://rainbowimportexports.com/exx/1kkw5sac6a0qwqea5cbrzv0m.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 02 May 2019 18:10:03 GMT
content-encoding
gzip
last-modified
Tue, 30 Apr 2019 11:41:31 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"5cc8346b-4d7"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=172800, public
cf-ray
4d0bf3252ad3bece-FRA
expires
Sat, 04 May 2019 18:10:03 GMT
js
www.googletagmanager.com/gtag/ 		63 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-121547863-1
Requested by
Host: rainbowimportexports.com
URL: https://rainbowimportexports.com/cdn-cgi/apps/head/mMu6RHcqOH9oQszpBNncBL37_Ow.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2008 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Google Tag Manager (scaffolding) /
Resource Hash
244da76b2ce8656ad358d0478ab5e6b19387ecedc91b26ecb17d3100aa4c8f56
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://rainbowimportexports.com/exx/1kkw5sac6a0qwqea5cbrzv0m.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 02 May 2019 18:10:03 GMT
content-encoding
br
last-modified
Wed, 01 May 2019 22:14:49 GMT
server
Google Tag Manager (scaffolding)
access-control-allow-origin
http://www.googletagmanager.com
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
status
200
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
content-length
24722
x-xss-protection
0
expires
Thu, 02 May 2019 18:10:03 GMT
css
fonts.googleapis.com/ 		0
569 B 		Other
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:600
Requested by
Host: rainbowimportexports.com
URL: https://rainbowimportexports.com/exx/1kkw5sac6a0qwqea5cbrzv0m.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Purpose
prefetch
Referer
https://rainbowimportexports.com/exx/1kkw5sac6a0qwqea5cbrzv0m.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Thu, 02 May 2019 18:10:03 GMT
server
ESF
access-control-allow-origin
*
date
Thu, 02 May 2019 18:10:03 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
status
200
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection
0
expires
Thu, 02 May 2019 18:10:03 GMT
truncated
/ 		2 KB
2 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
29b7a9358abdc68c51db5a5af4a4f4e2e041a67527adee2366b1f84f116fe9a5

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Origin
https://rainbowimportexports.com

Response headers

Content-Type
application/octet-stream
analytics.js
www.google-analytics.com/ 		43 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-121547863-1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81c::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://rainbowimportexports.com/exx/1kkw5sac6a0qwqea5cbrzv0m.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 16 Jan 2019 20:01:45 GMT
server
Golfe2
age
2254
date
Thu, 02 May 2019 17:32:29 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
17543
expires
Thu, 02 May 2019 19:32:29 GMT
collect
www.google-analytics.com/r/ 		35 B
104 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j73&a=1991674942&t=pageview&_s=1&dl=https%3A%2F%2Frainbowimportexports.com%2Fexx%2F1kkw5sac6a0qwqea5cbrzv0m.php%3Frand%3D13InboxLightaspxn.1774256418%26fid%261252899642%26fid.1%26fav.1%26email%3D&ul=en-us&de=UTF-8&dt=Sharing%20Link%20Validation&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUAB~&jid=304888256&gjid=514753524&cid=1738902405.1556820604&tid=UA-121547863-1&_gid=244921206.1556820604&_r=1&gtm=2ou430&z=434711699
Requested by
Host: rainbowimportexports.com
URL: https://rainbowimportexports.com/exx/1kkw5sac6a0qwqea5cbrzv0m.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81c::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://rainbowimportexports.com/exx/1kkw5sac6a0qwqea5cbrzv0m.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 02 May 2019 18:10:03 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
access-control-allow-origin
*
content-type
image/gif
status
200
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sharepoint (Online) Microsoft (Consumer)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask object| Eager object| CloudflareApps object| dataLayer object| google_tag_manager string| GoogleAnalyticsObject function| ga object| google_tag_data object| gaplugins object| gaGlobal object| gaData

4 Cookies

Domain/Path Name / Value
.rainbowimportexports.com/ Name: _gid
Value: GA1.2.244921206.1556820604
.rainbowimportexports.com/ Name: _ga
Value: GA1.2.1738902405.1556820604
.rainbowimportexports.com/ Name: _gat_gtag_UA_121547863_1
Value: 1
.rainbowimportexports.com/ Name: __cfduid
Value: d80e6251035f1efb40a9021a961be9ecd1556820602