URL: https://wtbg.pages.dev/tags/cloudflare-spectrum/
Submission Tags: @ecarlesi possiblethreat phishing Search All
Submission: On February 19 via api from IT — Scanned from NL

Summary

This website contacted 6 IPs in 3 countries across 6 domains to perform 9 HTTP transactions. The main IP is 188.114.97.3, located in Amsterdam, Netherlands and belongs to CLOUDFLARENET, US. The main domain is wtbg.pages.dev.
TLS certificate: Issued by GTS CA 1P5 on February 19th 2024. Valid for: 3 months.
This is the only time wtbg.pages.dev was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
3 188.114.97.3 13335 (CLOUDFLAR...)
1 163.181.92.236 24429 (TAOBAO Zh...)
1 216.58.206.42 15169 (GOOGLE)
1 142.250.185.200 15169 (GOOGLE)
2 216.239.32.36 15169 (GOOGLE)
1 142.250.184.195 15169 (GOOGLE)
9 6
Apex Domain
Subdomains
Transfer
3 pages.dev
wtbg.pages.dev
10 KB
2 google-analytics.com
region1.google-analytics.com — Cisco Umbrella Rank: 2000
307 B
1 gstatic.com
fonts.gstatic.com
126 KB
1 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 52
91 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 48
775 B
1 bytecdntp.com
lf3-cdn-tos.bytecdntp.com — Cisco Umbrella Rank: 207828
23 KB
9 6
Domain Requested by
3 wtbg.pages.dev wtbg.pages.dev
2 region1.google-analytics.com www.googletagmanager.com
1 fonts.gstatic.com fonts.googleapis.com
1 www.googletagmanager.com wtbg.pages.dev
1 fonts.googleapis.com wtbg.pages.dev
1 lf3-cdn-tos.bytecdntp.com wtbg.pages.dev
9 6

This site contains links to these domains. Also see Links.

Domain
blog.wittoy.com
github.com
risehere.net
mak1t0.cc
Subject Issuer Validity Valid
wtbg.pages.dev
GTS CA 1P5
2024-02-19 -
2024-05-19
3 months crt.sh
*.bytecdntp.com
RapidSSL Global TLS RSA4096 SHA256 2022 CA1
2023-06-30 -
2024-07-30
a year crt.sh
upload.video.google.com
GTS CA 1C3
2024-01-29 -
2024-04-22
3 months crt.sh
*.google-analytics.com
GTS CA 1C3
2024-01-29 -
2024-04-22
3 months crt.sh
*.gstatic.com
GTS CA 1C3
2024-01-29 -
2024-04-22
3 months crt.sh

This page contains 1 frames:

Primary Page: https://wtbg.pages.dev/tags/cloudflare-spectrum/
Frame ID: A2363D544FE35294B8A9708714ADCE90
Requests: 9 HTTP requests in this frame

Screenshot

Page Title

CloudFlare Spectrum | 璃落

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

6
Domains

6
Subdomains

6
IPs

3
Countries

252 kB
Transfer

592 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
wtbg.pages.dev/tags/cloudflare-spectrum/
6 KB
3 KB
Document
General
Full URL
https://wtbg.pages.dev/tags/cloudflare-spectrum/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0f65dfc9bd37cc200d6234f661640dafe4b64b279d35a0aff1992dcba91f7e14
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
cache-control
public, max-age=0, must-revalidate
cf-ray
858222875bed669a-AMS
content-encoding
br
content-type
text/html; charset=utf-8
date
Mon, 19 Feb 2024 23:01:59 GMT
etag
W/"cd5e00c1d3f7e8bf5a64c37a92cade5d"
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2GGfgyKIF0tO4qxgk%2FhzhNP0vScJxtQ2Lz14Jbn3FeZRgMAvf%2F8HHu6%2FilXvyozgjQLXbNszkOd2OZAMC9RDMxHHoHdQWK2GZzN16vfTg4YYG6Km2SPRVh667UVsc%2FKQlw%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-content-type-options
nosniff
bootstrap.min.css
lf3-cdn-tos.bytecdntp.com/cdn/expire-1-y/twitter-bootstrap/4.3.1/css/
152 KB
23 KB
Stylesheet
General
Full URL
https://lf3-cdn-tos.bytecdntp.com/cdn/expire-1-y/twitter-bootstrap/4.3.1/css/bootstrap.min.css
Requested by
Host: wtbg.pages.dev
URL: https://wtbg.pages.dev/tags/cloudflare-spectrum/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
163.181.92.236 Frankfurt am Main, Germany, ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN),
Reverse DNS
Software
Tengine /
Resource Hash
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://wtbg.pages.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date
Sun, 18 Feb 2024 22:08:41 GMT
content-encoding
gzip
via
cache14.l2de2[0,0,200-0,H], cache2.l2de2[1,0], ens-cache12.de5[0,0,200-0,H], ens-cache2.de5[3,0]
x-tt-trace-tag
id=03;cdn-cache=hit;type=static
x-tt-trace-id
00-240219060841F6A183138BB0EC22E8D1-65995E5817F1EB08-00
age
89600
x-swift-cachetime
31447031
x-cache
HIT TCP_MEM_HIT dirn:12:212909009
server-timing
inner; dur=13
x-swift-savetime
Mon, 19 Feb 2024 22:51:30 GMT
content-length
23237
last-modified
Fri, 28 Jan 2022 14:58:16 GMT
server
Tengine
x-tt-logid
20240219060841F6A183138BB0EC22E8D1
etag
W/"61f40488-2606e"
vary
Accept-Encoding
ali-swift-global-savetime
1708294121
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
x-tt-trace-host
016a5b9ad8a439797576ae17a5a5d50fcee7a881ec937f0000ee74cd98fe0feb1d2f9ed931bc2516d9745334180635bbb5e6fd8cf5f32ea1f7a136cc81be9b5e7050a65f416c57289fb3e708906f113288
x-response-cinfo
212.7.210.170
x-response-cache
edge_hit
timing-allow-origin
*, *
eagleid
a3b55c9617083837219896591e
expires
Mon, 17 Feb 2025 22:13:14 GMT
dark-mode.min.f3d691a38bc555779e3cb649e9f73dab3d0f5321c05b920b1d5a3445405f4753.css
wtbg.pages.dev/scss/
28 KB
4 KB
Stylesheet
General
Full URL
https://wtbg.pages.dev/scss/dark-mode.min.f3d691a38bc555779e3cb649e9f73dab3d0f5321c05b920b1d5a3445405f4753.css
Requested by
Host: wtbg.pages.dev
URL: https://wtbg.pages.dev/tags/cloudflare-spectrum/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f3d691a38bc555779e3cb649e9f73dab3d0f5321c05b920b1d5a3445405f4753
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://wtbg.pages.dev/tags/cloudflare-spectrum/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date
Mon, 19 Feb 2024 23:01:59 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"d80713a9f3e59ce56bb4833a94a36f33"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=29As%2FOWg0e6TuQ0NqPejF4tJ0OCdryDmA5KjfhocnKr3Z7jRKxK7BW20sqq3kzk2AEfNw6w5oqlA1sWq1ykvGNGlBYho5ibp9TaGiMQuJ5lBPxuhGLXTsjA6CH%2FdNxagpA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
85822287cc79669a-AMS
alt-svc
h3=":443"; ma=86400
css
fonts.googleapis.com/
569 B
775 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Material+Icons
Requested by
Host: wtbg.pages.dev
URL: https://wtbg.pages.dev/tags/cloudflare-spectrum/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.206.42 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil07s07-in-f10.1e100.net
Software
ESF /
Resource Hash
452410fef223a412e5608205fc069ecc35a4d919b413b3422a714a17ebfd0651
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://wtbg.pages.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Mon, 19 Feb 2024 23:01:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Mon, 19 Feb 2024 23:01:59 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 19 Feb 2024 23:01:59 GMT
js
www.googletagmanager.com/gtag/
272 KB
91 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-N59H4X096S
Requested by
Host: wtbg.pages.dev
URL: https://wtbg.pages.dev/tags/cloudflare-spectrum/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.200 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f8.1e100.net
Software
Google Tag Manager /
Resource Hash
754ca3ce69337e832de5d83a7248ec2f009a568efe6b0a88cd52dbf55843f606
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://wtbg.pages.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date
Mon, 19 Feb 2024 23:02:00 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
93164
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Mon, 19 Feb 2024 23:02:00 GMT
journal.js
wtbg.pages.dev/js/
8 KB
3 KB
Script
General
Full URL
https://wtbg.pages.dev/js/journal.js
Requested by
Host: wtbg.pages.dev
URL: https://wtbg.pages.dev/tags/cloudflare-spectrum/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3b2115bb4ab76f0164fb93cd214c90c78dbfda3840d7e62ad5112b7bb254f0d2
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://wtbg.pages.dev/tags/cloudflare-spectrum/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date
Mon, 19 Feb 2024 23:01:59 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"53ec7eb8e12421f61acdedcd766bbd5d"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EEF4gAxHS8Wkox1yLSNLiOppJQmk1qZH3p7Rfv6sUKkFAvWSk5KfEMDYARzTv%2BdCc9YWU1FS0AgFZfDtgFEqCZLUIHnspDfVWtsdE4fbjAG%2BFhyTAxq5NS4kpMs4T5gguA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
85822287cc7a669a-AMS
alt-svc
h3=":443"; ma=86400
collect
region1.google-analytics.com/g/
0
253 B
Ping
General
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-N59H4X096S&gtm=45je42e0v9134537713za200&_p=1708383722029&gcd=13l3l3l3l1&npa=0&dma_cps=-&dma=1&cid=246459118.1708383722&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_s=1&sid=1708383722&sct=1&seg=0&dl=https%3A%2F%2Fwtbg.pages.dev%2Ftags%2Fcloudflare-spectrum%2F&dt=CloudFlare%20Spectrum%20%7C%20%E7%92%83%E8%90%BD&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&ep.anonymize_ip=false&tfd=2831
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-N59H4X096S
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.239.32.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://wtbg.pages.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 19 Feb 2024 23:02:02 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://wtbg.pages.dev
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2
fonts.gstatic.com/s/materialicons/v141/
125 KB
126 KB
Font
General
Full URL
https://fonts.gstatic.com/s/materialicons/v141/flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Material+Icons
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.184.195 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s11-in-f3.1e100.net
Software
sffe /
Resource Hash
8265f64786397d6b832d1ca0aafdf149ad84e72759fffa9f7272e91a0fb015d1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://wtbg.pages.dev
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date
Thu, 15 Feb 2024 17:34:54 GMT
x-content-type-options
nosniff
age
365228
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
128352
x-xss-protection
0
last-modified
Wed, 31 Jan 2024 23:11:27 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 14 Feb 2025 17:34:54 GMT
collect
region1.google-analytics.com/g/
0
54 B
Ping
General
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-N59H4X096S&gtm=45je42e0v9134537713za200&_p=1708383722029&gcd=13l3l3l3l1&npa=0&dma_cps=-&dma=1&cid=246459118.1708383722&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_eu=AEA&_s=2&sid=1708383722&sct=1&seg=0&dl=https%3A%2F%2Fwtbg.pages.dev%2Ftags%2Fcloudflare-spectrum%2F&dt=CloudFlare%20Spectrum%20%7C%20%E7%92%83%E8%90%BD&en=scroll&ep.anonymize_ip=false&epn.percent_scrolled=90&_et=7&tfd=7841
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-N59H4X096S
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.239.32.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://wtbg.pages.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 19 Feb 2024 23:02:07 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://wtbg.pages.dev
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| google_tag_manager object| google_tag_data object| dataLayer boolean| doNotTrack function| gtag object| googletag object| gaGlobal function| debounce function| sgn function| handleScroll boolean| isDarkMode function| toggleDarkMode function| openDrawer function| closeDrawer

2 Cookies

Domain/Path Name / Value
.wtbg.pages.dev/ Name: _ga
Value: GA1.1.246459118.1708383722
.wtbg.pages.dev/ Name: _ga_N59H4X096S
Value: GS1.1.1708383722.1.0.1708383722.0.0.0

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff