urlscan.io logo urlscan.io
SecurityTrails logo

eu.visitorletterword.xyz Open in urlscan Pro
2606:4700:3037::681b:b93b  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/index.html?siteid=YjY0MTg1OTQwMDc0MTg1NzY4OTM1OCMxNTk3NDg3MzUyQ...
Submission: On August 15 via manual from IL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 5 domains to perform 15 HTTP transactions. The main IP is 2606:4700:3037::681b:b93b, located in United States and belongs to CLOUDFLARENET, US. The main domain is eu.visitorletterword.xyz.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 27th 2020. Valid for: a year.
This is the only time eu.visitorletterword.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Scam (Online)

Domain & IP information

IP Address AS Autonomous System
14 2606:4700:303... 13335 (CLOUDFLAR...)
1 1 34.249.64.153 16509 (AMAZON-02)
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
1 2606:4700:303... 13335 (CLOUDFLAR...)
15 2
14    2606:4700:3037::681b:b93b (United States)

ASN13335 (CLOUDFLARENET, US)
eu.visitorletterword.xyz
1    34.249.64.153 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-249-64-153.eu-west-1.compute.amazonaws.com
metatep.com
1    2606:4700:3035::6818:6a7e (United States)

ASN13335 (CLOUDFLARENET, US)
starforallgenerations.com
1    2606:4700:3035::ac43:8072 (United States)

ASN13335 (CLOUDFLARENET, US)
hitthattarget.com
1    2606:4700:3037::6812:36d3 (United States)

ASN13335 (CLOUDFLARENET, US)
mrng00.got2have8.com
Domain Requested by
14 eu.visitorletterword.xyz eu.visitorletterword.xyz
1 mrng00.got2have8.com eu.visitorletterword.xyz
1 hitthattarget.com 1 redirects
1 starforallgenerations.com 1 redirects
1 metatep.com 1 redirects
15 5

This site contains links to these domains. Also see Links.

Domain
www.lijits.com
Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-07-27 -
2021-07-27		 a year crt.sh

This page contains 2 frames:

Primary Page: https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/index.html?siteid=YjY0MTg1OTQwMDc0MTg1NzY4OTM1OCMxNTk3NDg3MzUyQDU4MzdAXzlmZTE4NGJhNTA5NmQyNDI0ZmJhYzJhMzJhMDNjYjY5&trackid=202008151029233584&ourl64_=aHR0cHM6Ly9tZXRhdGVwLmNvbS8_YT03ODY5JmM9MjYzNTQmczI9MjAyMDA4MTUxMDI5MjMzNTg0
Frame ID: 20D18783E4FEB62B541C547F5C4ED365
Requests: 14 HTTP requests in this frame

Frame: https://mrng00.got2have8.com/il/?o=2016&r=ewb164735739gk6e&a=23&sa=7869
Frame ID: FADE2CFBDDAEFA7EC38AA3B04BB30519
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i

Page Statistics

15
Requests

100 %
HTTPS

80 %
IPv6

5
Domains

5
Subdomains

2
IPs

2
Countries

120 kB
Transfer

228 kB
Size

5
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 13
  • https://metatep.com/?a=7869&c=26354&s2=202008151029233584 HTTP 302
  • https://starforallgenerations.com/?a=23&c=2006&s1=7869&s2=25421-548576644&s4= HTTP 302
  • https://hitthattarget.com/?a=23&c=2006&s1=7869&s2=25421-548576644&s4=&ckmguid=538a0b24-87d2-4cfd-93e4-6a88ce4de0e0 HTTP 302
  • https://mrng00.got2have8.com/il/?o=2016&r=ewb164735739gk6e&a=23&sa=7869

15 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request index.html
eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/ 		37 KB
7 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/index.html?siteid=YjY0MTg1OTQwMDc0MTg1NzY4OTM1OCMxNTk3NDg3MzUyQDU4MzdAXzlmZTE4NGJhNTA5NmQyNDI0ZmJhYzJhMzJhMDNjYjY5&trackid=202008151029233584&ourl64_=aHR0cHM6Ly9tZXRhdGVwLmNvbS8_YT03ODY5JmM9MjYzNTQmczI9MjAyMDA4MTUxMDI5MjMzNTg0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::681b:b93b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4b96f26f732b54324036f91f1c47093a2fccc694bb9f3d6ec9f522e452e6caf7

Request headers

:method
GET
:authority
eu.visitorletterword.xyz
:scheme
https
:path
/b3ccf64558dc569d91e6d57b2e1c9dda/index.html?siteid=YjY0MTg1OTQwMDc0MTg1NzY4OTM1OCMxNTk3NDg3MzUyQDU4MzdAXzlmZTE4NGJhNTA5NmQyNDI0ZmJhYzJhMzJhMDNjYjY5&trackid=202008151029233584&ourl64_=aHR0cHM6Ly9tZXRhdGVwLmNvbS8_YT03ODY5JmM9MjYzNTQmczI9MjAyMDA4MTUxMDI5MjMzNTg0
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
date
Sat, 15 Aug 2020 11:56:01 GMT
content-type
text/html
set-cookie
__cfduid=d6cd3315b5e9364d3e092bc8f452ec07d1597492561; expires=Mon, 14-Sep-20 11:56:01 GMT; path=/; domain=.visitorletterword.xyz; HttpOnly; SameSite=Lax
cache-control
no-cache
cf-cache-status
DYNAMIC
cf-request-id
0493931f55000063b3b0a68200000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
5c32badeeb4563b3-FRA
content-encoding
br
css.css
eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/css/ 		2 KB
469 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/css/css.css
Requested by
Host: eu.visitorletterword.xyz
URL: https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/index.html?siteid=YjY0MTg1OTQwMDc0MTg1NzY4OTM1OCMxNTk3NDg3MzUyQDU4MzdAXzlmZTE4NGJhNTA5NmQyNDI0ZmJhYzJhMzJhMDNjYjY5&trackid=202008151029233584&ourl64_=aHR0cHM6Ly9tZXRhdGVwLmNvbS8_YT03ODY5JmM9MjYzNTQmczI9MjAyMDA4MTUxMDI5MjMzNTg0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::681b:b93b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ed7da92a1bd3ca33ff7eb510a906749463c22ef746b49417d0dfa920c5ca4ea4

Request headers

Referer
https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/index.html?siteid=YjY0MTg1OTQwMDc0MTg1NzY4OTM1OCMxNTk3NDg3MzUyQDU4MzdAXzlmZTE4NGJhNTA5NmQyNDI0ZmJhYzJhMzJhMDNjYjY5&trackid=202008151029233584&ourl64_=aHR0cHM6Ly9tZXRhdGVwLmNvbS8_YT03ODY5JmM9MjYzNTQmczI9MjAyMDA4MTUxMDI5MjMzNTg0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 15 Aug 2020 11:56:01 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
1588840036
server
cloudflare
age
4814
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=14400
cf-ray
5c32badf5b7c63b3-FRA
cf-request-id
0493931f95000063b3b0a6a200000001
style.css
eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/css/ 		9 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/css/style.css
Requested by
Host: eu.visitorletterword.xyz
URL: https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/index.html?siteid=YjY0MTg1OTQwMDc0MTg1NzY4OTM1OCMxNTk3NDg3MzUyQDU4MzdAXzlmZTE4NGJhNTA5NmQyNDI0ZmJhYzJhMzJhMDNjYjY5&trackid=202008151029233584&ourl64_=aHR0cHM6Ly9tZXRhdGVwLmNvbS8_YT03ODY5JmM9MjYzNTQmczI9MjAyMDA4MTUxMDI5MjMzNTg0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::681b:b93b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0e1738656188750583af6e1b25b451e6e2754db7f55b540e62a6fea5cd2b7a33

Request headers

Referer
https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/index.html?siteid=YjY0MTg1OTQwMDc0MTg1NzY4OTM1OCMxNTk3NDg3MzUyQDU4MzdAXzlmZTE4NGJhNTA5NmQyNDI0ZmJhYzJhMzJhMDNjYjY5&trackid=202008151029233584&ourl64_=aHR0cHM6Ly9tZXRhdGVwLmNvbS8_YT03ODY5JmM9MjYzNTQmczI9MjAyMDA4MTUxMDI5MjMzNTg0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 15 Aug 2020 11:56:01 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
1588840058
server
cloudflare
age
4814
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=14400
cf-ray
5c32badf5b7d63b3-FRA
cf-request-id
0493931f96000063b3b0a6b200000001
logo.png
eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/img/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/img/logo.png
Requested by
Host: eu.visitorletterword.xyz
URL: https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/index.html?siteid=YjY0MTg1OTQwMDc0MTg1NzY4OTM1OCMxNTk3NDg3MzUyQDU4MzdAXzlmZTE4NGJhNTA5NmQyNDI0ZmJhYzJhMzJhMDNjYjY5&trackid=202008151029233584&ourl64_=aHR0cHM6Ly9tZXRhdGVwLmNvbS8_YT03ODY5JmM9MjYzNTQmczI9MjAyMDA4MTUxMDI5MjMzNTg0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::681b:b93b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
99f22131449ebb5d2f18422e1488e91f27e228c55aec7092da80a5db8ce8ad13

Request headers

Referer
https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/index.html?siteid=YjY0MTg1OTQwMDc0MTg1NzY4OTM1OCMxNTk3NDg3MzUyQDU4MzdAXzlmZTE4NGJhNTA5NmQyNDI0ZmJhYzJhMzJhMDNjYjY5&trackid=202008151029233584&ourl64_=aHR0cHM6Ly9tZXRhdGVwLmNvbS8_YT03ODY5JmM9MjYzNTQmczI9MjAyMDA4MTUxMDI5MjMzNTg0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 15 Aug 2020 11:56:01 GMT
cf-cache-status
HIT
last-modified
1588840049
server
cloudflare
age
4814
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5c32badf5b8863b3-FRA
content-length
10334
cf-request-id
0493931f9b000063b3b0a6f200000001
iphone-11pro.png
eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/img/ 		20 KB
20 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/img/iphone-11pro.png
Requested by
Host: eu.visitorletterword.xyz
URL: https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/index.html?siteid=YjY0MTg1OTQwMDc0MTg1NzY4OTM1OCMxNTk3NDg3MzUyQDU4MzdAXzlmZTE4NGJhNTA5NmQyNDI0ZmJhYzJhMzJhMDNjYjY5&trackid=202008151029233584&ourl64_=aHR0cHM6Ly9tZXRhdGVwLmNvbS8_YT03ODY5JmM9MjYzNTQmczI9MjAyMDA4MTUxMDI5MjMzNTg0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::681b:b93b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a8623ba93a525f8a6502568774bb9b4962a9f4f503e858f9fcd3d39471b5929d

Request headers

Referer
https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/index.html?siteid=YjY0MTg1OTQwMDc0MTg1NzY4OTM1OCMxNTk3NDg3MzUyQDU4MzdAXzlmZTE4NGJhNTA5NmQyNDI0ZmJhYzJhMzJhMDNjYjY5&trackid=202008151029233584&ourl64_=aHR0cHM6Ly9tZXRhdGVwLmNvbS8_YT03ODY5JmM9MjYzNTQmczI9MjAyMDA4MTUxMDI5MjMzNTg0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 15 Aug 2020 11:56:01 GMT
cf-cache-status
HIT
last-modified
1588840036
server
cloudflare
age
4814
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5c32badf5b8a63b3-FRA
content-length
20865
cf-request-id
0493931f9b000063b3b0a70200000001
samsung_s10.jpg
eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/img/ 		20 KB
20 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/img/samsung_s10.jpg
Requested by
Host: eu.visitorletterword.xyz
URL: https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/index.html?siteid=YjY0MTg1OTQwMDc0MTg1NzY4OTM1OCMxNTk3NDg3MzUyQDU4MzdAXzlmZTE4NGJhNTA5NmQyNDI0ZmJhYzJhMzJhMDNjYjY5&trackid=202008151029233584&ourl64_=aHR0cHM6Ly9tZXRhdGVwLmNvbS8_YT03ODY5JmM9MjYzNTQmczI9MjAyMDA4MTUxMDI5MjMzNTg0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::681b:b93b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4908ade959c9401b33e00569c3ce722cb2411651b535d58e336550638b428cfc

Request headers

Referer
https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/index.html?siteid=YjY0MTg1OTQwMDc0MTg1NzY4OTM1OCMxNTk3NDg3MzUyQDU4MzdAXzlmZTE4NGJhNTA5NmQyNDI0ZmJhYzJhMzJhMDNjYjY5&trackid=202008151029233584&ourl64_=aHR0cHM6Ly9tZXRhdGVwLmNvbS8_YT03ODY5JmM9MjYzNTQmczI9MjAyMDA4MTUxMDI5MjMzNTg0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 15 Aug 2020 11:56:01 GMT
cf-cache-status
HIT
last-modified
1588840036
server
cloudflare
age
4814
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5c32badf5b8b63b3-FRA
content-length
20796
cf-request-id
0493931f9b000063b3b0a71200000001
apple_watch.jpg
eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/img/ 		25 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/img/apple_watch.jpg
Requested by
Host: eu.visitorletterword.xyz
URL: https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/index.html?siteid=YjY0MTg1OTQwMDc0MTg1NzY4OTM1OCMxNTk3NDg3MzUyQDU4MzdAXzlmZTE4NGJhNTA5NmQyNDI0ZmJhYzJhMzJhMDNjYjY5&trackid=202008151029233584&ourl64_=aHR0cHM6Ly9tZXRhdGVwLmNvbS8_YT03ODY5JmM9MjYzNTQmczI9MjAyMDA4MTUxMDI5MjMzNTg0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::681b:b93b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
63494675287bb7496664c7f3c63c2f58111cef845d10231afef53f824f76b5e6

Request headers

Referer
https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/index.html?siteid=YjY0MTg1OTQwMDc0MTg1NzY4OTM1OCMxNTk3NDg3MzUyQDU4MzdAXzlmZTE4NGJhNTA5NmQyNDI0ZmJhYzJhMzJhMDNjYjY5&trackid=202008151029233584&ourl64_=aHR0cHM6Ly9tZXRhdGVwLmNvbS8_YT03ODY5JmM9MjYzNTQmczI9MjAyMDA4MTUxMDI5MjMzNTg0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 15 Aug 2020 11:56:01 GMT
cf-cache-status
HIT
last-modified
1588840036
server
cloudflare
age
4814
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5c32badf5b8c63b3-FRA
content-length
25212
cf-request-id
0493931f9b000063b3b0a72200000001
disqus_hr.gif
eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/img/ 		90 B
175 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/img/disqus_hr.gif
Requested by
Host: eu.visitorletterword.xyz
URL: https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/index.html?siteid=YjY0MTg1OTQwMDc0MTg1NzY4OTM1OCMxNTk3NDg3MzUyQDU4MzdAXzlmZTE4NGJhNTA5NmQyNDI0ZmJhYzJhMzJhMDNjYjY5&trackid=202008151029233584&ourl64_=aHR0cHM6Ly9tZXRhdGVwLmNvbS8_YT03ODY5JmM9MjYzNTQmczI9MjAyMDA4MTUxMDI5MjMzNTg0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::681b:b93b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
afe0c709cf4b479c6c621957b265236e04898760fde3bb29939db4afef4d13c0

Request headers

Referer
https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/index.html?siteid=YjY0MTg1OTQwMDc0MTg1NzY4OTM1OCMxNTk3NDg3MzUyQDU4MzdAXzlmZTE4NGJhNTA5NmQyNDI0ZmJhYzJhMzJhMDNjYjY5&trackid=202008151029233584&ourl64_=aHR0cHM6Ly9tZXRhdGVwLmNvbS8_YT03ODY5JmM9MjYzNTQmczI9MjAyMDA4MTUxMDI5MjMzNTg0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 15 Aug 2020 11:56:01 GMT
cf-cache-status
HIT
last-modified
1588840036
server
cloudflare
age
4814
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
status
200
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5c32badf5b8d63b3-FRA
content-length
90
cf-request-id
0493931f9b000063b3b0a73200000001
loader2.gif
eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/img/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/img/loader2.gif
Requested by
Host: eu.visitorletterword.xyz
URL: https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/index.html?siteid=YjY0MTg1OTQwMDc0MTg1NzY4OTM1OCMxNTk3NDg3MzUyQDU4MzdAXzlmZTE4NGJhNTA5NmQyNDI0ZmJhYzJhMzJhMDNjYjY5&trackid=202008151029233584&ourl64_=aHR0cHM6Ly9tZXRhdGVwLmNvbS8_YT03ODY5JmM9MjYzNTQmczI9MjAyMDA4MTUxMDI5MjMzNTg0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::681b:b93b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
81f8c055e3b99087883460c942b82d796fe5d2512101511e85d395b7a1690738

Request headers

Referer
https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/index.html?siteid=YjY0MTg1OTQwMDc0MTg1NzY4OTM1OCMxNTk3NDg3MzUyQDU4MzdAXzlmZTE4NGJhNTA5NmQyNDI0ZmJhYzJhMzJhMDNjYjY5&trackid=202008151029233584&ourl64_=aHR0cHM6Ly9tZXRhdGVwLmNvbS8_YT03ODY5JmM9MjYzNTQmczI9MjAyMDA4MTUxMDI5MjMzNTg0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 15 Aug 2020 11:56:01 GMT
cf-cache-status
HIT
last-modified
1588840036
server
cloudflare
age
4814
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
status
200
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5c32badf5b8e63b3-FRA
content-length
1818
cf-request-id
0493931f9b000063b3b0a74200000001
sweet-alert.css
eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/css/ 		9 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/css/sweet-alert.css
Requested by
Host: eu.visitorletterword.xyz
URL: https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/index.html?siteid=YjY0MTg1OTQwMDc0MTg1NzY4OTM1OCMxNTk3NDg3MzUyQDU4MzdAXzlmZTE4NGJhNTA5NmQyNDI0ZmJhYzJhMzJhMDNjYjY5&trackid=202008151029233584&ourl64_=aHR0cHM6Ly9tZXRhdGVwLmNvbS8_YT03ODY5JmM9MjYzNTQmczI9MjAyMDA4MTUxMDI5MjMzNTg0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::681b:b93b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
57255e0e66ff61d16f7cd191f5669d68a4b8a90eef93a76ad1de809b02156cae

Request headers

Referer
https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/index.html?siteid=YjY0MTg1OTQwMDc0MTg1NzY4OTM1OCMxNTk3NDg3MzUyQDU4MzdAXzlmZTE4NGJhNTA5NmQyNDI0ZmJhYzJhMzJhMDNjYjY5&trackid=202008151029233584&ourl64_=aHR0cHM6Ly9tZXRhdGVwLmNvbS8_YT03ODY5JmM9MjYzNTQmczI9MjAyMDA4MTUxMDI5MjMzNTg0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 15 Aug 2020 11:56:01 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
1588840059
server
cloudflare
age
4814
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=14400
cf-ray
5c32badf5b8463b3-FRA
cf-request-id
0493931f9b000063b3b0a6c200000001
jquery.min.js
eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/js/ 		82 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/js/jquery.min.js
Requested by
Host: eu.visitorletterword.xyz
URL: https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/index.html?siteid=YjY0MTg1OTQwMDc0MTg1NzY4OTM1OCMxNTk3NDg3MzUyQDU4MzdAXzlmZTE4NGJhNTA5NmQyNDI0ZmJhYzJhMzJhMDNjYjY5&trackid=202008151029233584&ourl64_=aHR0cHM6Ly9tZXRhdGVwLmNvbS8_YT03ODY5JmM9MjYzNTQmczI9MjAyMDA4MTUxMDI5MjMzNTg0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::681b:b93b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5

Request headers

Referer
https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/index.html?siteid=YjY0MTg1OTQwMDc0MTg1NzY4OTM1OCMxNTk3NDg3MzUyQDU4MzdAXzlmZTE4NGJhNTA5NmQyNDI0ZmJhYzJhMzJhMDNjYjY5&trackid=202008151029233584&ourl64_=aHR0cHM6Ly9tZXRhdGVwLmNvbS8_YT03ODY5JmM9MjYzNTQmczI9MjAyMDA4MTUxMDI5MjMzNTg0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 15 Aug 2020 11:56:01 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
1588840036
server
cloudflare
age
4814
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=14400
cf-ray
5c32badf5b8663b3-FRA
cf-request-id
0493931f9b000063b3b0a6d200000001
script.js
eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/js/ 		2 KB
567 B 		Script
General
Check archive.org
Download Go to
Full URL
https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/js/script.js
Requested by
Host: eu.visitorletterword.xyz
URL: https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/index.html?siteid=YjY0MTg1OTQwMDc0MTg1NzY4OTM1OCMxNTk3NDg3MzUyQDU4MzdAXzlmZTE4NGJhNTA5NmQyNDI0ZmJhYzJhMzJhMDNjYjY5&trackid=202008151029233584&ourl64_=aHR0cHM6Ly9tZXRhdGVwLmNvbS8_YT03ODY5JmM9MjYzNTQmczI9MjAyMDA4MTUxMDI5MjMzNTg0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::681b:b93b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9929bee8ade1b7b02b60ad8de00af9af969c7c4aaa61dcc51c216c30e07dcfe2

Request headers

Referer
https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/index.html?siteid=YjY0MTg1OTQwMDc0MTg1NzY4OTM1OCMxNTk3NDg3MzUyQDU4MzdAXzlmZTE4NGJhNTA5NmQyNDI0ZmJhYzJhMzJhMDNjYjY5&trackid=202008151029233584&ourl64_=aHR0cHM6Ly9tZXRhdGVwLmNvbS8_YT03ODY5JmM9MjYzNTQmczI9MjAyMDA4MTUxMDI5MjMzNTg0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 15 Aug 2020 11:56:01 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
1588840036
server
cloudflare
age
4814
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=14400
cf-ray
5c32badf5b8763b3-FRA
cf-request-id
0493931f9b000063b3b0a6e200000001
style.css
eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/css/ 		9 KB
2 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/css/style.css
Requested by
Host: eu.visitorletterword.xyz
URL: https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/css/style.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::681b:b93b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0e1738656188750583af6e1b25b451e6e2754db7f55b540e62a6fea5cd2b7a33

Request headers

Origin
https://eu.visitorletterword.xyz
Referer
https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/css/style.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 15 Aug 2020 11:56:01 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
1588840058
server
cloudflare
age
4814
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=14400
cf-ray
5c32badf8bbb63b3-FRA
cf-request-id
0493931fb5000063b3b0a78200000001
css.css
eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/css/ 		2 KB
421 B 		Font
General
Check archive.org
Download Go to
Full URL
https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/css/css.css
Requested by
Host: eu.visitorletterword.xyz
URL: https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/css/css.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::681b:b93b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ed7da92a1bd3ca33ff7eb510a906749463c22ef746b49417d0dfa920c5ca4ea4

Request headers

Origin
https://eu.visitorletterword.xyz
Referer
https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/css/css.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 15 Aug 2020 11:56:01 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
1588840036
server
cloudflare
age
4814
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=14400
cf-ray
5c32badf8bbc63b3-FRA
cf-request-id
0493931fb7000063b3b0a79200000001
/
mrng00.got2have8.com/il/ Frame FADE
Redirect Chain
  • https://metatep.com/?a=7869&c=26354&s2=202008151029233584
  • https://starforallgenerations.com/?a=23&c=2006&s1=7869&s2=25421-548576644&s4=
  • https://hitthattarget.com/?a=23&c=2006&s1=7869&s2=25421-548576644&s4=&ckmguid=538a0b24-87d2-4cfd-93e4-6a88ce4de0e0
  • https://mrng00.got2have8.com/il/?o=2016&r=ewb164735739gk6e&a=23&sa=7869
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://mrng00.got2have8.com/il/?o=2016&r=ewb164735739gk6e&a=23&sa=7869
Requested by
Host: eu.visitorletterword.xyz
URL: https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/index.html?siteid=YjY0MTg1OTQwMDc0MTg1NzY4OTM1OCMxNTk3NDg3MzUyQDU4MzdAXzlmZTE4NGJhNTA5NmQyNDI0ZmJhYzJhMzJhMDNjYjY5&trackid=202008151029233584&ourl64_=aHR0cHM6Ly9tZXRhdGVwLmNvbS8_YT03ODY5JmM9MjYzNTQmczI9MjAyMDA4MTUxMDI5MjMzNTg0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::6812:36d3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
mrng00.got2have8.com
:scheme
https
:path
/il/?o=2016&r=ewb164735739gk6e&a=23&sa=7869
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/index.html?siteid=YjY0MTg1OTQwMDc0MTg1NzY4OTM1OCMxNTk3NDg3MzUyQDU4MzdAXzlmZTE4NGJhNTA5NmQyNDI0ZmJhYzJhMzJhMDNjYjY5&trackid=202008151029233584&ourl64_=aHR0cHM6Ly9tZXRhdGVwLmNvbS8_YT03ODY5JmM9MjYzNTQmczI9MjAyMDA4MTUxMDI5MjMzNTg0
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://eu.visitorletterword.xyz/b3ccf64558dc569d91e6d57b2e1c9dda/index.html?siteid=YjY0MTg1OTQwMDc0MTg1NzY4OTM1OCMxNTk3NDg3MzUyQDU4MzdAXzlmZTE4NGJhNTA5NmQyNDI0ZmJhYzJhMzJhMDNjYjY5&trackid=202008151029233584&ourl64_=aHR0cHM6Ly9tZXRhdGVwLmNvbS8_YT03ODY5JmM9MjYzNTQmczI9MjAyMDA4MTUxMDI5MjMzNTg0

Response headers

status
200
date
Sat, 15 Aug 2020 11:56:02 GMT
content-type
text/html; charset=UTF-8
set-cookie
__cfduid=dd1095a1786d988b0e06e167084175f0e1597492562; expires=Mon, 14-Sep-20 11:56:02 GMT; path=/; domain=.got2have8.com; HttpOnly; SameSite=Lax; Secure PHPSESSID_MS=av4706m8a2su6r84pgjs84c2d3; expires=Mon, 17-Aug-2020 11:56:02 GMT; Max-Age=172800; path=/
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
cf-cache-status
DYNAMIC
cf-request-id
04939323210000d70df7a0b200000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
5c32bae50963d70d-FRA
content-encoding
br

Redirect headers

status
302
date
Sat, 15 Aug 2020 11:56:02 GMT
content-type
text/html; charset=utf-8
set-cookie
__cfduid=d082b90b03510aae1089f7b76e3cec9811597492562; expires=Mon, 14-Sep-20 11:56:02 GMT; path=/; domain=.hitthattarget.com; HttpOnly; SameSite=Lax; Secure st=tRUGeyzOLMU9yJbQJ3MSoJYvnPl9A8JpsG9O2Xmhd/i/LnHNVDM85A==; domain=.hitthattarget.com; path=/; HttpOnly tm=rUdfOD3FiZC6PB5E/sb0cJYvnPl9A8JpsG9O2Xmhd/i/LnHNVDM85A==; domain=.hitthattarget.com; expires=Fri, 15-Aug-2025 11:55:55 GMT; path=/; HttpOnly c2016=tRUGeyzOLMUJxcd+Y+9zM6iB8Ggpzw79n3Qats4NeJ7z7rqBSvVRyQ==; domain=.hitthattarget.com; expires=Mon, 14-Sep-2020 11:55:55 GMT; path=/; HttpOnly
cache-control
private
location
https://mrng00.got2have8.com/il/?o=2016&r=ewb164735739gk6e&a=23&sa=7869
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cf-cache-status
DYNAMIC
cf-request-id
04939322230000c2f4aa16b200000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
5c32bae3694ac2f4-FRA

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Scam (Online)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes function| getURLParameter function| fun_date string| time2 function| $ function| jQuery boolean| exitpop function| start_second_timer function| start_minute_timer function| startSurvey function| checkAnswers function| endSurvey boolean| remaining_show function| blink_remaining function| setAlertState

5 Cookies

Domain/Path Name / Value
.got2have8.com/ Name: _gat
Value: 1
.got2have8.com/ Name: _gid
Value: GA1.2.1284033775.1597492563
.got2have8.com/ Name: _ga
Value: GA1.2.1842907614.1597492563
mrng00.got2have8.com/ Name: PHPSESSID_MS
Value: av4706m8a2su6r84pgjs84c2d3
.visitorletterword.xyz/ Name: __cfduid
Value: d6cd3315b5e9364d3e092bc8f452ec07d1597492561