Submitted URL: https://link.pr.clinicsense.com/ls/click?upn=u001.bixIXbrw0kaFkQEgg0TJdJO27CKAqXGfVGQAaNLgrYEbbiA23K1QZvrDsQWnSL-2FWew2k_ES0ShO6...
Effective URL: https://lliuovirn.com/?id=iluvi
Submission Tags: 0xscam
Submission: On April 18 via api from US — Scanned from DE

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 7 HTTP transactions. The main IP is 172.67.149.221, located in United States and belongs to CLOUDFLARENET, US. The main domain is lliuovirn.com.
TLS certificate: Issued by GTS CA 1P5 on April 17th 2024. Valid for: 3 months.
This is the only time lliuovirn.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 13.32.27.97 16509 (AMAZON-02)
1 6 172.67.149.221 13335 (CLOUDFLAR...)
1 2a06:98c1:312... 13335 (CLOUDFLAR...)
1 104.16.123.96 13335 (CLOUDFLAR...)
7 3
Apex Domain
Subdomains
Transfer
6 lliuovirn.com
lliuovirn.com
12 KB
1 cloudflare.com
www.cloudflare.com — Cisco Umbrella Rank: 6039
3 KB
1 serviops.ca
www.serviops.ca
29 KB
1 clinicsense.com
link.pr.clinicsense.com
280 B
7 4
Domain Requested by
6 lliuovirn.com 1 redirects lliuovirn.com
1 www.cloudflare.com
1 www.serviops.ca lliuovirn.com
1 link.pr.clinicsense.com 1 redirects
7 4

This site contains no links.

Subject Issuer Validity Valid
lliuovirn.com
GTS CA 1P5
2024-04-17 -
2024-07-16
3 months crt.sh
serviops.ca
GTS CA 1P5
2024-02-25 -
2024-05-25
3 months crt.sh
www.cloudflare.com
E1
2024-04-05 -
2024-07-04
3 months crt.sh

This page contains 2 frames:

Primary Page: https://lliuovirn.com/?id=iluvi
Frame ID: 4880FC3CBE9DFDA2260A918CB1BB6336
Requests: 4 HTTP requests in this frame

Frame: https://lliuovirn.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/54ea73d52131/main.js
Frame ID: F4105FE62F00D1D07CCD8E55E3E94626
Requests: 3 HTTP requests in this frame

Screenshot

Page Title

CloudFlare - Verify that you are a human

Page URL History Show full URLs

  1. https://link.pr.clinicsense.com/ls/click?upn=u001.bixIXbrw0kaFkQEgg0TJdJO27CKAqXGfVGQAaNLgrYEbbiA23K1QZvrDsQ... HTTP 302
    https://lliuovirn.com/?id=iluvi Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/

Page Statistics

7
Requests

86 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

44 kB
Transfer

56 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://link.pr.clinicsense.com/ls/click?upn=u001.bixIXbrw0kaFkQEgg0TJdJO27CKAqXGfVGQAaNLgrYEbbiA23K1QZvrDsQWnSL-2FWew2k_ES0ShO6fv3-2F6pmZ1UabGtd2fhCFNuntBej-2BU7tJpCEpQLwWUNLwAEpVOLSMmhXvzy-2Fa9hdA4y-2FG1OkTfNpxDL0lBsvMXXmUf-2BJOb6GetUvGM38Mv6iPvUOv3VT1E3KKcuAFtHAUSziIH4yJdFR9NoSoypFHe-2FHHKZQvophNN62BMqj811ZKKTr-2FF7TVORNqNat3Hwz4a5N4aTwcpdEbvS8se76QkUPUi3Iy4qNgfoeJLqDkPjrA811gk5x7Gx1HonujmAuECOpqVxhh3BJ0-2FW2dqb8Aw-2FtDDOiA2RqtVOqAet6dhWdSgHpNzbWyMy7xdnh9NlUpsZTbvtdR4BCGu0Tg3rUDLc9eM-2FOHXD-2FMO-2FdQ-3D HTTP 302
    https://lliuovirn.com/?id=iluvi Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2
  • https://lliuovirn.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
  • https://lliuovirn.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/54ea73d52131/main.js

7 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
lliuovirn.com/
Redirect Chain
  • https://link.pr.clinicsense.com/ls/click?upn=u001.bixIXbrw0kaFkQEgg0TJdJO27CKAqXGfVGQAaNLgrYEbbiA23K1QZvrDsQWnSL-2FWew2k_ES0ShO6fv3-2F6pmZ1UabGtd2fhCFNuntBej-2BU7tJpCEpQLwWUNLwAEpVOLSMmhXvzy-2Fa9hd...
  • https://lliuovirn.com/?id=iluvi
6 KB
2 KB
Document
General
Full URL
https://lliuovirn.com/?id=iluvi
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.149.221 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3ab077d2b160c58b49364e77f165c6968388ad566bf147843c11aaef78bcaaa6

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8766f17ee879bb61-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Thu, 18 Apr 2024 19:08:25 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pSf5RMsc9LQTNBBNMwiHlFOCIt%2FUUx1hmqon8xnNUw37DsSy35cD3wS32K6QQJJrLzXCqpuer047LKyFqHud74WEiSt1z%2FUILZPsFz%2B0qWP0JBbeXo6%2BXRl%2BQKjyb5ix"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
54
content-type
text/html; charset=utf-8
date
Thu, 18 Apr 2024 19:08:24 GMT
location
https://lliuovirn.com/?id=iluvi
server
nginx
via
1.1 95adda0bdbd310a1a9e4f54f540543e2.cloudfront.net (CloudFront)
x-amz-cf-id
zWlDjAgo8uDrpA5x7OGwrHuB8p8RC932KChtsOcT_gboHiTC2JmUhw==
x-amz-cf-pop
FRA56-C2
x-cache
Miss from cloudfront
x-robots-tag
noindex, nofollow
rocket-loader.min.js
lliuovirn.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/
12 KB
4 KB
Script
General
Full URL
https://lliuovirn.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Requested by
Host: lliuovirn.com
URL: https://lliuovirn.com/?id=iluvi
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.149.221 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://lliuovirn.com/?id=iluvi
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 18 Apr 2024 19:08:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 16 Apr 2024 15:45:04 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"661e9d00-302c"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QelKJsFS28%2FafLcaYCLYlLziV0tXtTVFiORk1JcYbyG%2F8rJTt%2FXSh49UqDMdAnlXrTQ6Z%2F8xL5yVLSjGX92sH7Hl4axa3itcBP4jSI9EQPKUSFtY7ByczbBVzsMkzghj"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
x-frame-options
DENY
cache-control
max-age=172800, public
cf-ray
8766f180aad1bb61-FRA
expires
Sat, 20 Apr 2024 19:08:25 GMT
Cloudflare_logo.svg_.png
www.serviops.ca/wp-content/uploads/2015/11/
28 KB
29 KB
Image
General
Full URL
https://www.serviops.ca/wp-content/uploads/2015/11/Cloudflare_logo.svg_.png
Requested by
Host: lliuovirn.com
URL: https://lliuovirn.com/?id=iluvi
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2b8a39ef4484a9c2b7d89a76e562cf9d5d920d07d5cf55d3f200cea52d0f8792
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://lliuovirn.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 18 Apr 2024 19:08:25 GMT
strict-transport-security
max-age=31536000
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
7004
alt-svc
h3=":443"; ma=86400
content-length
29039
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Sun, 15 Oct 2017 15:37:03 GMT
server
cloudflare
etag
"716f-55b97a95a25c0"
x-frame-options
SAMEORIGIN, SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Rk8sQLYjOK7SRsBvKXM7cud9edHiSOtT5EDg7WyzE4WNr0cNNPBijglhO4Iws2YCpBihGRFqebyxv2PyUt9ftAjjs18tnEFE8d%2B5QhwOHh6kdje5j%2FoVLPXTXD44%2Be35gIt3cmoSBtwY3yA9QJo%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
vary
Accept-Encoding
cache-control
max-age=691200
accept-ranges
bytes
cf-ray
8766f18128669225-FRA
main.js
lliuovirn.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/54ea73d52131/ Frame F410
Redirect Chain
  • https://lliuovirn.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
  • https://lliuovirn.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/54ea73d52131/main.js
8 KB
4 KB
Script
General
Full URL
https://lliuovirn.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/54ea73d52131/main.js
Protocol
H3
Server
172.67.149.221 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ac6a47b7a64b3c0a5a1d015008b3bb3325faa896bccab1cb9f2f65835f27af6d
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Apr 2024 19:08:25 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xX9nxBFr4Mi0KNMmBJhKDSdR9HYJZiC6eNUi06XprQIZvZ1OURlDbnC7uI8thT4HjAt%2BFQsHDWGpuWPgLK00bb2FK5AAZA2raDVaUMDGD0s%2BF%2BETblZoZvAhAVcOelpn"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400, public
cf-ray
8766f1810b39bb61-FRA
alt-svc
h3=":443"; ma=86400

Redirect headers

date
Thu, 18 Apr 2024 19:08:25 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4C8AEAUjRPhfAZGrhEs5Mye70WTZ2NdZG%2B9hpPeAc8EF9oM0JItRDS5mwsKxQLvcsxDM3%2BNsfueP5b8oRKT0qq9yuVXxGWAeCj8yEJ75TAPKRxv0gB7jhdEocrmdbppb"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
location
/cdn-cgi/challenge-platform/h/g/scripts/jsd/54ea73d52131/main.js
cache-control
max-age=300, public
cf-ray
8766f180db03bb61-FRA
alt-svc
h3=":443"; ma=86400
content-length
0
favicon.ico
www.cloudflare.com/
2 KB
3 KB
Other
General
Full URL
https://www.cloudflare.com/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.123.96 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0f84307ad691800e391fccb42b4ba290a87febf001abedfbe03b34767d45e441
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://lliuovirn.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-gww-loc
EN-US
date
Thu, 18 Apr 2024 19:08:25 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
etag
W/"ffb25f3edc5c56acfdf7e7cdffcb217c"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=g4XLIM0%2Brd8odpjNBPq%2FoeoSyZmje7PcO%2B4EjXwKaP3z9VTcfZeioKrjvXyJdG0omPoTsS8pE%2FvKHuqg9YoGoN%2FBYoGoicw5fV1GeFQ%2Buehc4HgbtI%2BXKfLE%2BHR31xTKNOhD5A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/vnd.microsoft.icon
vary
Accept-Encoding
cache-control
public, max-age=0, must-revalidate
permissions-policy
geolocation=(), camera=(), microphone=()
cf-ray
8766f181294d1c07-FRA
x-pgs-loc
EN-US
8766f17ee879bb61
lliuovirn.com/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame F410
0
576 B
XHR
General
Full URL
https://lliuovirn.com/cdn-cgi/challenge-platform/h/g/jsd/r/8766f17ee879bb61
Requested by
Host: lliuovirn.com
URL: https://lliuovirn.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.149.221 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform
"Win32"
Referer
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type
application/json

Response headers

date
Thu, 18 Apr 2024 19:08:25 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OEgT8ROzY7JYeHrYsLTMBL3KRHAntRYQsJz%2F4KYLE%2FbpFGakVYhck0IKM%2BihYX3zy1RDr5jO8zo0pw2OMzcsXVXh0yTbjjtR90zBuNtfRP40cu9cDQ8XBD4LDateFegX"}],"group":"cf-nel","max_age":604800}
content-type
text/plain; charset=UTF-8
cf-ray
8766f1819bf1bb61-FRA
alt-svc
h3=":443"; ma=86400
content-length
0
8766f17ee879bb61
lliuovirn.com/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame F410
0
577 B
XHR
General
Full URL
https://lliuovirn.com/cdn-cgi/challenge-platform/h/g/jsd/r/8766f17ee879bb61
Requested by
Host: lliuovirn.com
URL: https://lliuovirn.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.149.221 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform
"Win32"
Referer
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type
application/json

Response headers

date
Thu, 18 Apr 2024 19:08:25 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QF4LZgBdPSPH4mlLcGprIbS8atrYNGFHrWNM9woRvaMYGRbGK60tFfllU%2BkmCg%2FGiz2o%2BXSS1PjmBR10Mjkr6RmUlnxhYVLP8JJ0RhdLdVfyrKekk4Hr6lRhvvM3ryIe"}],"group":"cf-nel","max_age":604800}
content-type
text/plain; charset=UTF-8
cf-ray
8766f181dc3cbb61-FRA
alt-svc
h3=":443"; ma=86400
content-length
0

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| __cfQR boolean| __cfRLUnblockHandlers

2 Cookies

Domain/Path Name / Value
.www.cloudflare.com/ Name: __cf_bm
Value: Kttgh_KSBVubdOQ50dChKsYqx9APytIur4meH3NWZbw-1713467305-1.0.1.1-H9piPt7e43SFDztE0SCllH6lQppdhATypAcA_VFDbxZ9Ry4vNPY19ONK.LtIv2I3EkSBuGqbISx8sxWgDzHjRxYYK_bDjozjwkytHa2gRjs
.lliuovirn.com/ Name: cf_clearance
Value: DQZd9gEL1ivIhgPdJq6HwQa.V_yz6jZmYZqRFNK9ahc-1713467305-1.0.1.1-aN5So5s7kmaNssBjB42cPM7AXwn8VeRBQFY_5c.IG_Ut4V9cmOFQ0zaBd6_vMBIv2hL_NRavjQDiqfaNqS78kg

1 Console Messages

Source Level URL
Text
other warning URL: https://lliuovirn.com/?id=iluvi
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.