atwi.gq Open in urlscan Pro
2606:4700:3032::6812:3a05 Public Scan

URL:
http://atwi.gq/
Submission: On December 07 via manual (December 7th 2020, 12:22:04 pm UTC) from DK

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 8 HTTP transactions. The main IP is 2606:4700:3032::6812:3a05, located in United States and belongs to CLOUDFLARENET, US. The main domain is atwi.gq.

This is the only time atwi.gq was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
5	2606:4700:303... 2606:4700:3032::6812:3a05	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:820::200a	15169 (GOOGLE) (GOOGLE)
1	95.138.134.97 95.138.134.97	15395 (RACKSPACE...) (RACKSPACE-LON)
1	91.195.241.137 91.195.241.137	47846 (SEDO-AS) (SEDO-AS)
8	4

5 2606:4700:3032::6812:3a05 (United States)

ASN13335 (CLOUDFLARENET, US)

atwi.gq	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:820::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 95.138.134.97 (United Kingdom)

ASN15395 (RACKSPACE-LON, GB)
PTR: 462403-app1.atticusconsultancy.co.uk

www.spaandhotelbreak.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 91.195.241.137 (Germany)

ASN47846 (SEDO-AS, DE)

www.contactsrilanka.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	atwi.gq atwi.gq	25 KB
1	contactsrilanka.org www.contactsrilanka.org
1	spaandhotelbreak.co.uk www.spaandhotelbreak.co.uk
1	googleapis.com fonts.googleapis.com	2 KB
8	4

	Domain	Requested by
5	atwi.gq	atwi.gq
1	www.contactsrilanka.org	atwi.gq
1	www.spaandhotelbreak.co.uk	atwi.gq
1	fonts.googleapis.com	atwi.gq
8	4

This site contains no links.

Subject Issuer	Validity	Valid
spaandhotelbreak.co.uk Let's Encrypt Authority X3	`2020-11-10` - `2021-02-08`	3 months	crt.sh
contactsrilanka.org Encryption Everywhere DV TLS CA - G1	`2020-11-23` - `2021-11-23`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://atwi.gq/
Frame ID: DFD3F0BAAA6DCCE9CADE5B85A6B16C79
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

8
Requests

25 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

27 kB
Transfer

81 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set / Show response
atwi.gq/ 12 KB
5 KB 101ms
56ms Document
text/html 2606:4700:3032::6812:3a05
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://atwi.gq/
Protocol: HTTP/1.1
Server: 2606:4700:3032::6812:3a05 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c74034112568abe6c61c3ddbfdb918b87cef6181d7460c1f032f380bcaf4326f

Request headers

Host: atwi.gq
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 07 Dec 2020 12:21:47 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=ddd1de5a3cbfcd6fc9ba6e503dc4a0a121607343707; expires=Wed, 06-Jan-21 12:21:47 GMT; path=/; domain=.atwi.gq; HttpOnly; SameSite=Lax
set-cookie: ch1c=b
CF-Cache-Status: DYNAMIC
cf-request-id: 06debfae9f0000c27716bb5000000001
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=dXMimGnY2kOpgrBpcBogIfgyFVj9TZeAXWM0Q4fQeJw8rv%2BOlTQsvF8F4BdJP9uNCb4VKX245Y%2F%2FySCxo8%2BzjrBKit9hMpGqr8q1zxQGSMTQmkIq"}],"group":"cf-nel","max_age":604800}
NEL: {"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 5fde355dc9bcc277-FRA
Content-Encoding: gzip

GET
H/1.1 200
OK /
atwi.gq/ 12 KB
5 KB 36ms
35ms Stylesheet
text/html 2606:4700:3032::6812:3a05
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://atwi.gq/
Requested by: Host: atwi.gq
URL: http://atwi.gq/
Protocol: HTTP/1.1
Server: 2606:4700:3032::6812:3a05 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c74034112568abe6c61c3ddbfdb918b87cef6181d7460c1f032f380bcaf4326f

Request headers

Referer: http://atwi.gq/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 07 Dec 2020 12:21:47 GMT
Content-Encoding: gzip
CF-Cache-Status: DYNAMIC
NEL: {"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=%2B1adQ%2BXHaHmJTbceF%2BhHfBsmoPHYilKGHSEfC7nGkqZkAayYdl0tucixysZRVi8GgySuxXuUyJO4QFDGA6Ca%2FXKAd3RzEZ68fHjOmc1dUr%2FWwtmJ"}],"group":"cf-nel","max_age":604800}
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
CF-RAY: 5fde355e2aa5c277-FRA
cf-request-id: 06debfaedc0000c277e2ab5000000001

GET
H/1.1 200
OK css
fonts.googleapis.com/ 22 KB
2 KB 22ms
15ms Stylesheet
text/css 2a00:1450:4001:820::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.googleapis.com/css?family=Source+Sans+Pro%3A300%2C300i%2C400%2C400i%2C600%2C600i%2C700%2C700i%2C900%2C900i&subset=latin%2Clatin-ext

Requested by

Host: atwi.gq
URL: http://atwi.gq/

Protocol

HTTP/1.1

Server

2a00:1450:4001:820::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

78dc9db45c3782edccf234a74c65efd85ff34d45d139e7743fa1732b2789d225

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://atwi.gq/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 07 Dec 2020 12:21:47 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 07 Dec 2020 12:21:47 GMT
Server: ESF
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=86400, stale-while-revalidate=604800
Transfer-Encoding: chunked
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
X-XSS-Protection: 0
Expires: Mon, 07 Dec 2020 12:21:47 GMT

GET
H/1.1 200
OK / Show response
atwi.gq/ 12 KB
5 KB 42ms
36ms Script
text/html 2606:4700:3032::6812:3a05
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://atwi.gq/
Requested by: Host: atwi.gq
URL: http://atwi.gq/
Protocol: HTTP/1.1
Server: 2606:4700:3032::6812:3a05 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c74034112568abe6c61c3ddbfdb918b87cef6181d7460c1f032f380bcaf4326f

Request headers

Referer: http://atwi.gq/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 07 Dec 2020 12:21:47 GMT
Content-Encoding: gzip
CF-Cache-Status: DYNAMIC
NEL: {"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=m2EYn%2BQPboLL1IbBTjTm8pQtU8J3NSGDaIhM2BxIzx9F5d4suD%2BgsWcwQIYB0udBq0ZEPUxhj36PzVKv3V2w1onEXCjp9QW3ZMDWLBSqeBsHJevR"}],"group":"cf-nel","max_age":604800}
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
CF-RAY: 5fde355e3eab0631-FRA
cf-request-id: 06debfaee100000631c602e000000001

GET
H2 403 Spa_Breaks_Kent.jpg
www.spaandhotelbreak.co.uk/photos/cms/Spa_Breaks_South_East/ 0
0 271ms
75ms Image
text/html 95.138.134.97
RACKSPACE-LON

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.spaandhotelbreak.co.uk/photos/cms/Spa_Breaks_South_East/Spa_Breaks_Kent.jpg
Requested by: Host: atwi.gq
URL: http://atwi.gq/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.138.134.97 , United Kingdom, ASN15395 (RACKSPACE-LON, GB),
Reverse DNS: 462403-app1.atticusconsultancy.co.uk
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://atwi.gq/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H2 403 wp-emoji-release.min.js
www.contactsrilanka.org/wp-includes/js/ 0
0 298ms
56ms Script
text/html 91.195.241.137
SEDO-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.contactsrilanka.org/wp-includes/js/wp-emoji-release.min.js?ver=4.9.8
Requested by: Host: atwi.gq
URL: http://atwi.gq/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.195.241.137 , Germany, ASN47846 (SEDO-AS, DE),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: http://atwi.gq/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H/1.1 200
OK /
atwi.gq/ 12 KB
5 KB 60ms
55ms Stylesheet
text/html 2606:4700:3032::6812:3a05
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://atwi.gq/
Requested by: Host: atwi.gq
URL: http://atwi.gq/
Protocol: HTTP/1.1
Server: 2606:4700:3032::6812:3a05 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c74034112568abe6c61c3ddbfdb918b87cef6181d7460c1f032f380bcaf4326f

Request headers

Referer: http://atwi.gq/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 07 Dec 2020 12:21:47 GMT
Content-Encoding: gzip
CF-Cache-Status: DYNAMIC
NEL: {"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=sbopUohrcI3JR4lxV1RKJPdO6npsTUAihiYitIArW%2BKsTZM7ANCKir7PLerkoDaiQUWKKp9PFByK%2B75j2gxcaOcKuGVdCzsGjycxlKaivNPDsK5Z"}],"group":"cf-nel","max_age":604800}
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
CF-RAY: 5fde355e5d96e00b-FRA
cf-request-id: 06debfaefb0000e00b15288000000001

GET
H/1.1 200
OK / Show response
atwi.gq/ 12 KB
5 KB 34ms
34ms Script
text/html 2606:4700:3032::6812:3a05
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://atwi.gq/
Requested by: Host: atwi.gq
URL: http://atwi.gq/
Protocol: HTTP/1.1
Server: 2606:4700:3032::6812:3a05 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c74034112568abe6c61c3ddbfdb918b87cef6181d7460c1f032f380bcaf4326f

Request headers

Referer: http://atwi.gq/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 07 Dec 2020 12:21:47 GMT
Content-Encoding: gzip
CF-Cache-Status: DYNAMIC
NEL: {"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=AryR16vPMG8b%2FwhrycwSi1mTEK6nWBdwdhUOdBnhfcCN1aCQzi9O0vXVO5x%2B79YaoEuqJP5Y8qXDiqIC1QxqtEgDKoPMC3nhmAyhE1iq2vdAnK5a"}],"group":"cf-nel","max_age":604800}
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
CF-RAY: 5fde355ebe65e00b-FRA
cf-request-id: 06debfaf340000e00b102a4000000001

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			atwi.gq/	1969-12-31 23:59:59	Name: ch1c Value: b
			.atwi.gq/	1970-01-19 15:12:15	Name: __cfduid Value: ddd1de5a3cbfcd6fc9ba6e503dc4a0a121607343707

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

atwi.gq
fonts.googleapis.com
www.contactsrilanka.org
www.spaandhotelbreak.co.uk
2606:4700:3032::6812:3a05
2a00:1450:4001:820::200a
91.195.241.137
95.138.134.97
78dc9db45c3782edccf234a74c65efd85ff34d45d139e7743fa1732b2789d225
c74034112568abe6c61c3ddbfdb918b87cef6181d7460c1f032f380bcaf4326f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

atwi.gq Open in urlscan Pro 2606:4700:3032::6812:3a05 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

8 Requests

25 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

4 IPs

3 Countries

27 kBTransfer

81 kBSize

2 Cookies

0 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

2 Cookies

Indicators

atwi.gq Open in urlscan Pro
2606:4700:3032::6812:3a05 Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

25 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

27 kB
Transfer

81 kB
Size

2
Cookies

8 HTTP transactions
0 data transactions