Submitted URL: https://zoeann.net/ganas33-login-8/
Effective URL: https://eetotod.top/?id=12519&type=2&currency=IDR
Submission Tags: @phish_report
Submission: On November 10 via api from FI — Scanned from NL

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 8 HTTP transactions. The main IP is 23.99.98.89, located in Hong Kong, Hong Kong and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is eetotod.top.
TLS certificate: Issued by R10 on November 8th 2024. Valid for: 3 months.
This is the only time eetotod.top was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 6 188.114.96.3 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 23.99.98.89 8075 (MICROSOFT...)
8 3
Apex Domain
Subdomains
Transfer
6 zoeann.net
zoeann.net
11 KB
2 eetotod.top
eetotod.top
554 B
1 cloudflareinsights.com
static.cloudflareinsights.com — Cisco Umbrella Rank: 683
7 KB
8 3
Domain Requested by
6 zoeann.net 1 redirects static.cloudflareinsights.com
zoeann.net
2 eetotod.top zoeann.net
1 static.cloudflareinsights.com zoeann.net
8 3

This site contains no links.

Subject Issuer Validity Valid
zoeann.net
WE1
2024-11-05 -
2025-02-03
3 months crt.sh
cloudflareinsights.com
WE1
2024-11-01 -
2025-01-30
3 months crt.sh
eetotod.top
R10
2024-11-08 -
2025-02-06
3 months crt.sh

This page contains 2 frames:

Primary Page: https://eetotod.top/?id=12519&type=2&currency=IDR
Frame ID: 8FF94D832599EDFFBE148F103ADEB924
Requests: 6 HTTP requests in this frame

Frame: https://zoeann.net/cdn-cgi/challenge-platform/h/b/scripts/jsd/22755d9a86c9/main.js
Frame ID: 4ED54DD455A70877AE9A60EBED58F43A
Requests: 2 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://zoeann.net/ganas33-login-8/ Page URL
  2. https://eetotod.top/?id=12519&type=2&currency=IDR Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Page Statistics

8
Requests

88 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

18 kB
Transfer

32 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://zoeann.net/ganas33-login-8/ Page URL
  2. https://eetotod.top/?id=12519&type=2&currency=IDR Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2
  • https://zoeann.net/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
  • https://zoeann.net/cdn-cgi/challenge-platform/h/b/scripts/jsd/22755d9a86c9/main.js

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
zoeann.net/ganas33-login-8/
3 KB
2 KB
Document
General
Full URL
https://zoeann.net/ganas33-login-8/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8911c2a866a5705ca94bb2e0979da264171b7fd2b81f5ee21a95ee02f5344981

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8e035f9d9a9b0b5c-AMS
content-encoding
zstd
content-type
text/html; charset=UTF-8
date
Sun, 10 Nov 2024 04:42:01 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority
u=0,i
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nBCsRyasoHOPENbsoRjFwt65aHPV%2BctBDKyj9pM9ybF2I4Gp%2BTEk%2FQn0epwdfGl256twHwO6T1%2BihsqVXfS77XBtAXunYYd9DPGb%2FP5E2x49cB9M8RX%2FsaD29eBG"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfCacheStatus;desc="DYNAMIC" cfL4;desc="?proto=QUIC&rtt=14790&sent=13&recv=11&lost=0&retrans=0&sent_bytes=4260&recv_bytes=4571&delivery_rate=695&cwnd=12000&unsent_bytes=0&cid=f0f5db5792ec158c&ts=283&x=1" cfExtPri cfHdrFlush;dur=0
vary
Accept-Encoding
vcd15cbe7772f49c399c6a5babf22c1241717689176015
static.cloudflareinsights.com/beacon.min.js/
19 KB
7 KB
Script
General
Full URL
https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Requested by
Host: zoeann.net
URL: https://zoeann.net/ganas33-login-8/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5049 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Origin
https://zoeann.net
Referer
https://zoeann.net/

Response headers

cache-control
public, max-age=86400
content-encoding
gzip
etag
W/"2024.6.1"
cross-origin-resource-policy
cross-origin
cf-ray
8e035f9f78a66564-AMS
access-control-allow-origin
*
date
Sun, 10 Nov 2024 04:42:01 GMT
content-type
text/javascript;charset=UTF-8
last-modified
Thu, 06 Jun 2024 15:52:56 GMT
vary
Accept-Encoding
server
cloudflare
main.js
zoeann.net/cdn-cgi/challenge-platform/h/b/scripts/jsd/22755d9a86c9/ Frame 4ED5
Redirect Chain
  • https://zoeann.net/cdn-cgi/challenge-platform/scripts/jsd/main.js
  • https://zoeann.net/cdn-cgi/challenge-platform/h/b/scripts/jsd/22755d9a86c9/main.js?
8 KB
4 KB
Script
General
Full URL
https://zoeann.net/cdn-cgi/challenge-platform/h/b/scripts/jsd/22755d9a86c9/main.js?
Protocol
H3
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer

Response headers

cache-control
max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
zstd
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=93c%2BZWm9O34HTqmXKqmqdn1UIuppwl5vWlbPwY9UbbQQ5J%2FAbCc0bqQSHWGc4Hhip18jSO0nQXtpt8zfBNoqUZbv01JDLFptlgOMf2O%2Fyocik1R2UVFNmvtKSp4t"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8e035f9fec560b5c-AMS
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=16309&sent=22&recv=19&lost=0&retrans=0&sent_bytes=7482&recv_bytes=7507&delivery_rate=29069&cwnd=12000&unsent_bytes=0&cid=f0f5db5792ec158c&ts=477&x=1", cfExtPri, cfHdrFlush;dur=0
date
Sun, 10 Nov 2024 04:42:01 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
server
cloudflare
priority
u=3,i=?0

Redirect headers

cache-control
max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location
/cdn-cgi/challenge-platform/h/b/scripts/jsd/22755d9a86c9/main.js?
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qGkSbFetsyiIrYA5dvTnN8uubi1HoIhAen0VhVOtNgTxYvtH4MWzW592KQtWgdDOcD87q39ND8GN66YLeqm2wO%2Bfwip12maSjGfAs8KA61CHbJct6X4lDPFXGpHo"}],"group":"cf-nel","max_age":604800}
cf-ray
8e035f9fbc100b5c-AMS
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
0
server-timing
cfL4;desc="?proto=QUIC&rtt=16463&sent=20&recv=17&lost=0&retrans=0&sent_bytes=6769&recv_bytes=7159&delivery_rate=107126&cwnd=12000&unsent_bytes=0&cid=f0f5db5792ec158c&ts=452&x=1", cfExtPri, cfHdrFlush;dur=0
date
Sun, 10 Nov 2024 04:42:01 GMT
vary
Accept-Encoding
server
cloudflare
priority
u=3,i=?0
Primary Request /
eetotod.top/
31 B
277 B
Document
General
Full URL
https://eetotod.top/?id=12519&type=2&currency=IDR
Requested by
Host: zoeann.net
URL: https://zoeann.net/ganas33-login-8/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.99.98.89 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx /
Resource Hash
f0a07376d81e2da93b6b6ad9f1590c7b1eb5533baca322ab6bd310c295a7fff3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://zoeann.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

Connection
keep-alive
Content-Type
text/html; charset=utf-8
Date
Sun, 10 Nov 2024 04:42:03 GMT
Server
nginx
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Transfer-Encoding
chunked
rum
zoeann.net/cdn-cgi/
0
137 B
XHR
General
Full URL
https://zoeann.net/cdn-cgi/rum?
Requested by
Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
content-type
application/json
Referer
https://zoeann.net/ganas33-login-8/

Response headers

access-control-max-age
86400
access-control-allow-credentials
true
access-control-allow-methods
POST,OPTIONS
x-content-type-options
nosniff
cf-ray
8e035f9fbc190b5c-AMS
access-control-allow-origin
https://zoeann.net
date
Sun, 10 Nov 2024 04:42:01 GMT
vary
Origin
server
cloudflare
x-frame-options
DENY
8e035f9d9a9b0b5c
zoeann.net/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame 4ED5
0
1 KB
XHR
General
Full URL
https://zoeann.net/cdn-cgi/challenge-platform/h/b/jsd/r/8e035f9d9a9b0b5c
Requested by
Host: zoeann.net
URL: https://zoeann.net/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Content-Type
application/json
Referer

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h2NztHuRnijQ9U6hMgw12ZKRI7DYTUD%2B663%2BEecn2mL84t71ZV%2FSgVjHkRsgENzMFVSXGBY5mzUGAs7gja2bDBs0pkoFitvevIcqZfKbh7J9tWpQVLJph5W8%2Fe6M"}],"group":"cf-nel","max_age":604800}
cf-ray
8e035fa10d200b5c-AMS
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=17237&sent=35&recv=37&lost=0&retrans=0&sent_bytes=14949&recv_bytes=25241&delivery_rate=228418&cwnd=12000&unsent_bytes=0&cid=f0f5db5792ec158c&ts=669&x=1", cfExtPri, cfHdrFlush;dur=0
content-length
0
date
Sun, 10 Nov 2024 04:42:01 GMT
content-type
text/plain; charset=UTF-8
server
cloudflare
priority
u=1,i
favicon.ico
zoeann.net/
2 KB
3 KB
Other
General
Full URL
https://zoeann.net/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer
https://zoeann.net/ganas33-login-8/

Response headers

content-encoding
zstd
cf-cache-status
HIT
etag
W/"67237da2-7a6"
age
767
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dfZg4ZVT%2FeMdHYaTo%2FT9%2FYzj6Y3kQv%2FY8J8JWVdDY%2FYwd%2Fo2hl532ERoRCu13pscMfey%2BGVeG8Penxuol54oq1P1ACsm0016xcVG51yPSs1WvL%2FIGNASsb1zT558"}],"group":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=17237&sent=32&recv=37&lost=0&retrans=0&sent_bytes=12243&recv_bytes=25241&delivery_rate=228418&cwnd=12000&unsent_bytes=0&cid=f0f5db5792ec158c&ts=668&x=1", cfExtPri, cfHdrFlush;dur=0
date
Sun, 10 Nov 2024 04:42:01 GMT
content-type
image/x-icon
last-modified
Thu, 31 Oct 2024 12:52:50 GMT
vary
Accept-Encoding
priority
u=1,i
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8e035fa11d210b5c-AMS
server
cloudflare
favicon.ico
eetotod.top/
31 B
277 B
Other
General
Full URL
https://eetotod.top/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.99.98.89 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx /
Resource Hash
f0a07376d81e2da93b6b6ad9f1590c7b1eb5533baca322ab6bd310c295a7fff3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer
https://eetotod.top/?id=12519&type=2&currency=IDR

Response headers

Transfer-Encoding
chunked
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Date
Sun, 10 Nov 2024 04:42:03 GMT
Content-Type
text/html; charset=utf-8
Server
nginx
Connection
keep-alive

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Domain/Path Name / Value
.zoeann.net/ Name: cf_clearance
Value: xgdkMnTH9oB_oAxvc6vR3TwbBJocAE8.FIpIqcoMhV4-1731213721-1.2.1.1-LTODjN1bf.pWyw61oRiYN_oFyCQFFnoh3rY3K5GaZf_6psckPJrJj2Zs7o76igY2Tc5Y1ShazH6iFQ7XJPHgXiGwcJ._L6zBLwTQsrjGgPgnLrUEWB6tdX4FiTGjqk0jXW__CtLX16R39NHOskPPyvaFFgkxvPEJU.61K1MvuzhN02WarXOzHLyFmQHaO8hwRML7ePBslRd1kJ3uPd2nEnAtonUfnmJlBMLpFPyEyFq76gt8Upwk6e8c0ichOSSNjUjQZEfRKJjSvDanuyKgqWZYbMWnzzw5Pt86U.h5EPxdq99qntQ5ZpQ7d2G4Lv73yEVSOK7W_lj4zCFPk68P3R5TW9V_Ju1B1LeidPIlAXlBypohztmWP3gcHZ6XYabJovHU1OhQ8X2VkNgTop8cxyDWb29Dd_AQujcnpyWy2fM

2 Console Messages

Source Level URL
Text
network error URL: https://eetotod.top/?id=12519&type=2&currency=IDR
Message:
Failed to load resource: the server responded with a status of 604 ()
network error URL: https://eetotod.top/favicon.ico
Message:
Failed to load resource: the server responded with a status of 604 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

eetotod.top
static.cloudflareinsights.com
zoeann.net
188.114.96.3
23.99.98.89
2606:4700::6810:5049
8911c2a866a5705ca94bb2e0979da264171b7fd2b81f5ee21a95ee02f5344981
f0a07376d81e2da93b6b6ad9f1590c7b1eb5533baca322ab6bd310c295a7fff3