urlscan.io logo urlscan.io
SecurityTrails logo

itsawinner.xyz Open in urlscan Pro
2600:9000:2490:6800:18:83b3:ad40:93a1  Public Scan

Go To Rescan Add Verdict Report
URL: https://itsawinner.xyz/auoptus-cash/index.html
Submission: On April 01 via automatic, source openphish — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 11 HTTP transactions. The main IP is 2600:9000:2490:6800:18:83b3:ad40:93a1, located in United States and belongs to AMAZON-02, US. The main domain is itsawinner.xyz.
TLS certificate: Issued by Amazon RSA 2048 M01 on March 15th 2023. Valid for: a year.
This is the only time itsawinner.xyz was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
7 2600:9000:249... 16509 (AMAZON-02)
3 139.45.197.250 9002 (RETN-AS)
1 139.45.195.8 9002 (RETN-AS)
11 3
Apex Domain
Subdomains		 Transfer
7 itsawinner.xyz
itsawinner.xyz
113 KB
3 desekansr.com
desekansr.com — Cisco Umbrella Rank: 244180
16 KB
1 rtmark.net
my.rtmark.net — Cisco Umbrella Rank: 10781
543 B
11 3
Domain Requested by
7 itsawinner.xyz itsawinner.xyz
3 desekansr.com itsawinner.xyz
desekansr.com
1 my.rtmark.net desekansr.com
11 3

This site contains no links.

Subject Issuer Validity Valid
itsawinner.xyz
Amazon RSA 2048 M01		 2023-03-15 -
2024-04-12		 a year crt.sh
desekansr.com
R3		 2023-03-28 -
2023-06-26		 3 months crt.sh
rtmark.net
R3		 2023-02-15 -
2023-05-16		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://itsawinner.xyz/auoptus-cash/index.html
Frame ID: 16737B25374C03D171BDCDB19B958533
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Optus

Page Statistics

11
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

129 kB
Transfer

243 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request index.html
itsawinner.xyz/auoptus-cash/ 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://itsawinner.xyz/auoptus-cash/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2490:6800:18:83b3:ad40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1270c781738b1d769be53a700e0c6b016e8af1538faa6750c7b3dc8e0d5f787f

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

age
37459
content-encoding
gzip
content-type
text/html
date
Fri, 31 Mar 2023 13:38:36 GMT
etag
W/"dd2bb917663510d663631c49424f6232"
last-modified
Fri, 31 Mar 2023 12:10:27 GMT
server
AmazonS3
vary
Accept-Encoding
via
1.1 409b27093eb36cec367cdee5f3ecf8b2.cloudfront.net (CloudFront)
x-amz-cf-id
it5Yzoq_D73XC8ETpZNCNXFND7BDMG26bzHSsaEciLP7jqWReOKh1Q==
x-amz-cf-pop
FRA56-P6
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
app.css
itsawinner.xyz/auoptus-cash/css/ 		309 B
663 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://itsawinner.xyz/auoptus-cash/css/app.css?id=2b8d5309d40668bd2ba4
Requested by
Host: itsawinner.xyz
URL: https://itsawinner.xyz/auoptus-cash/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2490:6800:18:83b3:ad40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
b894064a5e464372c66d036df3a577a8d9a4e927c47f16a02c036d8625eb3ca3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://itsawinner.xyz/auoptus-cash/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Fri, 31 Mar 2023 14:55:32 GMT
via
1.1 409b27093eb36cec367cdee5f3ecf8b2.cloudfront.net (CloudFront)
last-modified
Fri, 31 Mar 2023 12:10:27 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P6
age
32843
etag
"2b8d5309d40668bd2ba4b65a45a635a4"
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-type
text/css
accept-ranges
bytes
content-length
309
x-amz-cf-id
B9tdjVHWbgZBBLRnoEufX7VSBNNXt55MkQUk1zA9SFN56zUI_6fH6g==
app.css
itsawinner.xyz/auoptus-cash/css/landers/survey/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://itsawinner.xyz/auoptus-cash/css/landers/survey/app.css?id=3dea3cc428f109709a1b
Requested by
Host: itsawinner.xyz
URL: https://itsawinner.xyz/auoptus-cash/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2490:6800:18:83b3:ad40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2849b08042bdb384397e10b2900a42290c4e15927fca5766797e032e179dfbf1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://itsawinner.xyz/auoptus-cash/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Fri, 31 Mar 2023 13:36:42 GMT
content-encoding
br
via
1.1 409b27093eb36cec367cdee5f3ecf8b2.cloudfront.net (CloudFront)
last-modified
Fri, 31 Mar 2023 12:10:27 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P6
age
37572
etag
W/"8b6b5a6ad1ff6cc40005f6c84a3e1438"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
x-amz-cf-id
Cdm-UFBHqTxLSBMBAwdJ1mLmDVriGhcOsknYRXB1h06wIgBGnPg4Lw==
entel.png
itsawinner.xyz/auoptus-cash/img/landers/survey/ 		9 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://itsawinner.xyz/auoptus-cash/img/landers/survey/entel.png
Requested by
Host: itsawinner.xyz
URL: https://itsawinner.xyz/auoptus-cash/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2490:6800:18:83b3:ad40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
d7b505888328310fc769cdb36add55a8541d6d4c43e2ec72a03e18f8ee88af35

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://itsawinner.xyz/auoptus-cash/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Fri, 31 Mar 2023 14:55:33 GMT
via
1.1 409b27093eb36cec367cdee5f3ecf8b2.cloudfront.net (CloudFront)
last-modified
Fri, 31 Mar 2023 12:10:27 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P6
age
32842
etag
"74a3e3d3d0b5b3f6c420f14bdf2767fa"
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-type
image/png
accept-ranges
bytes
content-length
9690
x-amz-cf-id
PJ0gspi7k9tuBupfgEnX5JNFe18rn2nT_EPEwBCkKmgtF52bRJr6Xg==
default@0.25x.png
itsawinner.xyz/auoptus-cash/img/prizes/iphone-11-pro/ 		56 KB
56 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://itsawinner.xyz/auoptus-cash/img/prizes/iphone-11-pro/default@0.25x.png
Requested by
Host: itsawinner.xyz
URL: https://itsawinner.xyz/auoptus-cash/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2490:6800:18:83b3:ad40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
d034658713c51249da3df464698f4ed59cf58e569c7145cc3fd3fcba97da35b5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://itsawinner.xyz/auoptus-cash/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Fri, 31 Mar 2023 14:55:33 GMT
via
1.1 409b27093eb36cec367cdee5f3ecf8b2.cloudfront.net (CloudFront)
last-modified
Fri, 31 Mar 2023 12:10:27 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P6
age
32842
etag
"c589b66a6454cd93cd62674046d45847"
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-type
image/png
accept-ranges
bytes
content-length
57133
x-amz-cf-id
R9VrNbyfx5RVKZWFEaKiqn1Vfsvxaomh3GICP3kiVrNr2J7dlG45UQ==
app.js
itsawinner.xyz/auoptus-cash/js/ 		1 KB
1008 B 		Script
General
Check archive.org
Download Go to
Full URL
https://itsawinner.xyz/auoptus-cash/js/app.js?id=f9380415e1fafc78cfc9
Requested by
Host: itsawinner.xyz
URL: https://itsawinner.xyz/auoptus-cash/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2490:6800:18:83b3:ad40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a72d96732d7e4cd461456f7d199093f4dabd7e2e67ade896c8b787ce6bbceb88

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://itsawinner.xyz/auoptus-cash/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Fri, 31 Mar 2023 13:36:44 GMT
content-encoding
br
via
1.1 409b27093eb36cec367cdee5f3ecf8b2.cloudfront.net (CloudFront)
last-modified
Fri, 31 Mar 2023 12:10:27 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P6
age
37571
etag
W/"f9380415e1fafc78cfc942998f59598f"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
x-amz-cf-id
WIud9npzRGogMcpcyBOqvQw9D0DHdyYk_u_k0SVqIfUybDRlgPSKYQ==
app.js
itsawinner.xyz/auoptus-cash/js/landers/survey/ 		126 KB
41 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://itsawinner.xyz/auoptus-cash/js/landers/survey/app.js?id=a2e44b85ce440753c01a
Requested by
Host: itsawinner.xyz
URL: https://itsawinner.xyz/auoptus-cash/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2490:6800:18:83b3:ad40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6d294517ca91770f6c51e83c4a2597f89ee9c4ca3cd64377dabead42d266d69f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://itsawinner.xyz/auoptus-cash/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Fri, 31 Mar 2023 13:36:44 GMT
content-encoding
br
via
1.1 409b27093eb36cec367cdee5f3ecf8b2.cloudfront.net (CloudFront)
last-modified
Fri, 31 Mar 2023 12:10:28 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P6
age
37571
etag
W/"a2e44b85ce440753c01a2da1238d16e6"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
x-amz-cf-id
88l8B2IbdgYZp309f4S0Mxy4pAtx9bjQ1UmUhMH6dckmL1PkIkdhxA==
micro.tag.min.js
desekansr.com/pfe/current/ 		40 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://desekansr.com/pfe/current/micro.tag.min.js?z=5378963&sw=/sw-check-permissions-f40a4.js
Requested by
Host: itsawinner.xyz
URL: https://itsawinner.xyz/auoptus-cash/index.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.250 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
8f49474e7e523ffdca14d8bc07090261bd0c794d614edad2207f4b68e4de02e5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://itsawinner.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 01 Apr 2023 00:02:54 GMT
content-encoding
gzip
last-modified
Fri, 31 Mar 2023 12:18:44 GMT
server
nginx
etag
W/"6426cfa4-a164"
content-type
application/javascript
cache-control
no-cache
access-control-allow-credentials
true
zone
desekansr.com/ 		0
251 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://desekansr.com/zone?&pub=0&zone_id=5378963&is_mobile=false&domain=itsawinner.xyz&var=&ymid=&var_3=&var_4=&dsig=&action=prerequest
Requested by
Host: desekansr.com
URL: https://desekansr.com/pfe/current/micro.tag.min.js?z=5378963&sw=/sw-check-permissions-f40a4.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.250 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://itsawinner.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-trace-id
0c04ffdb4b130e677d16180918e2e473
date
Sat, 01 Apr 2023 00:02:54 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
server
nginx
access-control-allow-origin
https://itsawinner.xyz
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
content-length
0
gid.js
my.rtmark.net/ 		65 B
543 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://my.rtmark.net/gid.js?pub=0&userId=&zoneId=5378963&checkDuplicate=true&ymid=&var=
Requested by
Host: desekansr.com
URL: https://desekansr.com/pfe/current/micro.tag.min.js?z=5378963&sw=/sw-check-permissions-f40a4.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
ad36307ec9cdf21485dfd9f22c2acfe5eb6fbc0f282e9c8ab1f7fddfc7ecb252
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://itsawinner.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Sat, 01 Apr 2023 00:02:55 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
server
nginx
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/json; charset=utf-8
access-control-allow-origin
https://itsawinner.xyz
access-control-expose-headers
Authorization
access-control-allow-credentials
true
timing-allow-origin
*, *
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length
65
zone
desekansr.com/ 		939 B
1 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://desekansr.com/zone?&pub=0&zone_id=5378963&is_mobile=false&domain=itsawinner.xyz&var=&ymid=&var_3=&var_4=&dsig=&action=settings
Requested by
Host: desekansr.com
URL: https://desekansr.com/pfe/current/micro.tag.min.js?z=5378963&sw=/sw-check-permissions-f40a4.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.250 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
01f58949c74a16ee4f53f5a7d16c095a8bb9962b3d336f79f3c566df6301107b
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://itsawinner.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-trace-id
6db9eb64d0fb845607422635afa403e4
date
Sat, 01 Apr 2023 00:02:55 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
server
nginx
content-type
application/json; charset=utf-8
access-control-allow-origin
https://itsawinner.xyz
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
content-length
939

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| s function| getURLParameter function| go number| skip function| setImmediate function| clearImmediate object| zfgformats

1 Cookies

Domain/Path Name / Value
my.rtmark.net/ Name: ID
Value: 004c2526b9dc4a4788706022360ff76b