urlscan.io logo urlscan.io
SecurityTrails logo

captivatesmile.com Open in urlscan Pro
198.27.116.197  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://oruada.reflkeeder.com/1U0s0a7lq11vo3z-2lzhim1cyc00b1a11r6m00001
Effective URL: https://captivatesmile.com/176186ea08d3160b000/bank_0xb617b02a3b253e/yc0xb%7Cp2WwM2kiLzSf%7Cfths7%7C1vo3z%7C1a11r6m%7C63444...
Submission Tags: phishing
Submission: On October 29 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 4 countries across 3 domains to perform 2 HTTP transactions. The main IP is 198.27.116.197, located in Montreal, Canada and belongs to OVH, FR. The main domain is captivatesmile.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on July 12th 2021. Valid for: a year.
This is the only time captivatesmile.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 2 89.252.145.154 51559 (NETINTERN...)
1 198.27.116.197 16276 (OVH)
2 2
Apex Domain
Subdomains		 Transfer
2 reflkeeder.com
oruada.reflkeeder.com
883 B
1 captivatesmile.com
captivatesmile.com
477 B
0 404error.com Failed
404error.com Failed
2 3
Domain Requested by
2 oruada.reflkeeder.com 2 redirects
1 captivatesmile.com
0 404error.com Failed captivatesmile.com
2 3

This site contains no links.

Subject Issuer Validity Valid
captivatesmile.com
Sectigo RSA Domain Validation Secure Server CA		 2021-07-12 -
2022-07-12		 a year crt.sh

This page contains 1 frames:

Frame: https://404error.com/
Frame ID: 1CBBCC82BBEFFC3539B93FB45F89B083
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://oruada.reflkeeder.com/1U0s0a7lq11vo3z-2lzhim1cyc00b1a11r6m00001 HTTP 302
    http://oruada.reflkeeder.com/rdg.html?ln=11vo3z-syc617b02a3b20a6_vl_conv_s3vl_0xb5.2lzhim1a11r6m.U0000r16... HTTP 302
    https://captivatesmile.com/176186ea08d3160b000/bank_0xb617b02a3b253e/yc0xb%7Cp2WwM2kiLzSf%7Cfths7%7C1vo... Page URL

Page Statistics

2
Requests

50 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

4
Countries

0 kB
Transfer

0 kB
Size

5
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://oruada.reflkeeder.com/1U0s0a7lq11vo3z-2lzhim1cyc00b1a11r6m00001 HTTP 302
    http://oruada.reflkeeder.com/rdg.html?ln=11vo3z-syc617b02a3b20a6_vl_conv_s3vl_0xb5.2lzhim1a11r6m.U0000r16k0i1cyc00b_xc1199.fths7 HTTP 302
    https://captivatesmile.com/176186ea08d3160b000/bank_0xb617b02a3b253e/yc0xb%7Cp2WwM2kiLzSf%7Cfths7%7C1vo3z%7C1a11r6m%7C63444%7C0000r16k0i%7CU%7CDzy6pTS0nS93LJy0%7CUnknown%7C3c86rsg/p3ywAwR3LwNlLGAvZwOuAy92oS9wo252K3ZmqzksZUuvAD== Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://www.maccstrak.com/MZC1FM/5M69ZWQ/?sub1=1201796680&source_id=690084&sub2=bank_0xb617b02a3b253e HTTP 302
  • https://lpstrk.com/click.php?key=ba2jyoax25owdn244ic3&externalid=4a90bd870f7a4784a5015110b20b075f&advertiser=396&affiliate=418&target=boa&source=690084&affiliatesource=690084 HTTP 302
  • https://404error.com/

2 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request p3ywAwR3LwNlLGAvZwOuAy92oS9wo252K3ZmqzksZUuvAD==
captivatesmile.com/176186ea08d3160b000/bank_0xb617b02a3b253e/yc0xb%7Cp2WwM2kiLzSf%7Cfths7%7C1vo3z%7C1a11r6m%7C63444%7C0000r16k0i%7CU%7CDzy6pTS0nS93LJy0%7CUnknown%7C3c86rsg/
Redirect Chain
  • http://oruada.reflkeeder.com/1U0s0a7lq11vo3z-2lzhim1cyc00b1a11r6m00001
  • http://oruada.reflkeeder.com/rdg.html?ln=11vo3z-syc617b02a3b20a6_vl_conv_s3vl_0xb5.2lzhim1a11r6m.U0000r16k0i1cyc00b_xc1199.fths7
  • https://captivatesmile.com/176186ea08d3160b000/bank_0xb617b02a3b253e/yc0xb%7Cp2WwM2kiLzSf%7Cfths7%7C1vo3z%7C1a11r6m%7C63444%7C0000r16k0i%7CU%7CDzy6pTS0nS93LJy0%7CUnknown%7C3c86rsg/p3ywAwR3LwNlLGAvZ...
164 B
477 B 		Document
General
Check archive.org
Download Go to
Full URL
https://captivatesmile.com/176186ea08d3160b000/bank_0xb617b02a3b253e/yc0xb%7Cp2WwM2kiLzSf%7Cfths7%7C1vo3z%7C1a11r6m%7C63444%7C0000r16k0i%7CU%7CDzy6pTS0nS93LJy0%7CUnknown%7C3c86rsg/p3ywAwR3LwNlLGAvZwOuAy92oS9wo252K3ZmqzksZUuvAD==
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
198.27.116.197 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
Accept-Language
de-DE,de;q=0.9

Response headers

Date
Fri, 29 Oct 2021 14:42:15 GMT
Server
Apache
Content-Length
164
Connection
close
Content-Type
text/html; charset=UTF-8

Redirect headers

Date
Fri, 29 Oct 2021 14:42:14 GMT
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
X-Powered-By
PHP/5.4.16
Location
https://captivatesmile.com/176186ea08d3160b000/bank_0xb617b02a3b253e/yc0xb|p2WwM2kiLzSf|fths7|1vo3z|1a11r6m|63444|0000r16k0i|U|Dzy6pTS0nS93LJy0|Unknown|3c86rsg/p3ywAwR3LwNlLGAvZwOuAy92oS9wo252K3ZmqzksZUuvAD==
Content-Length
0
Keep-Alive
timeout=5, max=99
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
/
404error.com/
Redirect Chain
  • https://www.maccstrak.com/MZC1FM/5M69ZWQ/?sub1=1201796680&source_id=690084&sub2=bank_0xb617b02a3b253e
  • https://lpstrk.com/click.php?key=ba2jyoax25owdn244ic3&externalid=4a90bd870f7a4784a5015110b20b075f&advertiser=396&affiliate=418&target=boa&source=690084&affiliatesource=690084
  • https://404error.com/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
404error.com
URL
https://404error.com/

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Domain/Path Name / Value
captivatesmile.com/ Name: uid28046
Value: 1201796680-20211029104215-a4f8206962ade9bf87c17fb2fbeaa1c1-
www.maccstrak.com/ Name: uniqueClick_5M69ZWQ
Value: 34286093-071b-4c8f-a6ac-3e03b7bddafe:1635518536
www.maccstrak.com/ Name: transaction_id
Value: 4a90bd870f7a4784a5015110b20b075f
lpstrk.com/ Name: uclick
Value: 16vcd5ir
lpstrk.com/ Name: uclickhash
Value: 16vcd5ir-16vcd5ir-oju3-0-kt0-2ta78n-2ta7wj-591ec9

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

404error.com
captivatesmile.com
oruada.reflkeeder.com
404error.com
198.27.116.197
89.252.145.154