urlscan.io logo urlscan.io
SecurityTrails logo

www.geolandarsweepstakes.com Open in urlscan Pro
104.18.31.106  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://campaign.rtm.com/realtimesocial/share.aspx?promotionId=10892&shareGuid=5c42ceda-5443-492f-934b-0535d518370f
Effective URL: https://www.geolandarsweepstakes.com/?shareClickGuid=0e0df09e-4262-47c0-8955-08974f6c41e1
Submission Tags: 0xscam
Submission: On October 14 via api from US — Scanned from IT
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 7 HTTP transactions. The main IP is 104.18.31.106, located in and belongs to CLOUDFLARENET, US. The main domain is www.geolandarsweepstakes.com.
TLS certificate: Issued by WE1 on September 12th 2024. Valid for: 3 months.
This is the only time www.geolandarsweepstakes.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 7 104.17.192.75 13335 (CLOUDFLAR...)
1 104.18.31.106 13335 (CLOUDFLAR...)
7 3
Apex Domain
Subdomains		 Transfer
7 rtm.com
campaign.rtm.com
17 KB
1 geolandarsweepstakes.com
www.geolandarsweepstakes.com
2 KB
7 2
Domain Requested by
7 campaign.rtm.com 2 redirects campaign.rtm.com
1 www.geolandarsweepstakes.com www.geolandarsweepstakes.com
7 2

This site contains no links.

Subject Issuer Validity Valid
rtm.com
WE1		 2024-10-09 -
2025-01-07		 3 months crt.sh
geolandarsweepstakes.com
WE1		 2024-09-12 -
2024-12-11		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://www.geolandarsweepstakes.com/?shareClickGuid=0e0df09e-4262-47c0-8955-08974f6c41e1
Frame ID: B464CF998CC5D91A7B2DC6FA052F8C0A
Requests: 5 HTTP requests in this frame

Frame: https://campaign.rtm.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/62ec4f065604/main.js
Frame ID: 384F106C79E26B6E6001F9B79AEF349D
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Attention Required! | Cloudflare

Page URL History Show full URLs

  1. https://campaign.rtm.com/realtimesocial/share.aspx?promotionId=10892&shareGuid=5c42ceda-5443-492f-934... Page URL
  2. https://campaign.rtm.com/realtimesocial/share.aspx?promotionId=10892&shareGuid=5c42ceda-5443-492f-934... HTTP 302
    https://www.geolandarsweepstakes.com/?shareClickGuid=0e0df09e-4262-47c0-8955-08974f6c41e1 Page URL

Page Statistics

7
Requests

71 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

19 kB
Transfer

35 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://campaign.rtm.com/realtimesocial/share.aspx?promotionId=10892&shareGuid=5c42ceda-5443-492f-934b-0535d518370f Page URL
  2. https://campaign.rtm.com/realtimesocial/share.aspx?promotionId=10892&shareGuid=5c42ceda-5443-492f-934b-0535d518370f HTTP 302
    https://www.geolandarsweepstakes.com/?shareClickGuid=0e0df09e-4262-47c0-8955-08974f6c41e1 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2
  • https://campaign.rtm.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
  • https://campaign.rtm.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/62ec4f065604/main.js

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
share.aspx
campaign.rtm.com/realtimesocial/ 		3 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://campaign.rtm.com/realtimesocial/share.aspx?promotionId=10892&shareGuid=5c42ceda-5443-492f-934b-0535d518370f
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.192.75 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
f0abab6dff01314465e9dfca4912918156a4957359436133b5a1efc00036a14b

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control
private
cf-cache-status
DYNAMIC
cf-ray
8d2926fdbf690f66-MXP
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Mon, 14 Oct 2024 17:05:06 GMT
server
cloudflare
vary
Accept-Encoding
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
rocket-loader.min.js
campaign.rtm.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ 		12 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://campaign.rtm.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Requested by
Host: campaign.rtm.com
URL: https://campaign.rtm.com/realtimesocial/share.aspx?promotionId=10892&shareGuid=5c42ceda-5443-492f-934b-0535d518370f
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.192.75 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://campaign.rtm.com/realtimesocial/share.aspx?promotionId=10892&shareGuid=5c42ceda-5443-492f-934b-0535d518370f

Response headers

cache-control
max-age=172800, public
content-encoding
gzip
etag
W/"67055fd4-302c"
x-content-type-options
nosniff
cf-ray
8d2927013b550f66-MXP
expires
Wed, 16 Oct 2024 17:05:06 GMT
date
Mon, 14 Oct 2024 17:05:06 GMT
content-type
application/javascript
last-modified
Tue, 08 Oct 2024 16:37:40 GMT
vary
Accept-Encoding
server
cloudflare
x-frame-options
DENY
main.js
campaign.rtm.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/62ec4f065604/ Frame 384F
Redirect Chain
  • https://campaign.rtm.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
  • https://campaign.rtm.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/62ec4f065604/main.js?
8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://campaign.rtm.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/62ec4f065604/main.js?
Protocol
H2
Server
104.17.192.75 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cf-ray
8d292702fd840f66-MXP
cache-control
max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
content-encoding
gzip
date
Mon, 14 Oct 2024 17:05:07 GMT
content-type
application/javascript; charset=UTF-8
server
cloudflare
x-content-type-options
nosniff

Redirect headers

cf-ray
8d2927025cb80f66-MXP
cache-control
max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location
/cdn-cgi/challenge-platform/h/b/scripts/jsd/62ec4f065604/main.js?
content-length
0
access-control-allow-origin
*
date
Mon, 14 Oct 2024 17:05:06 GMT
server
cloudflare
Primary Request /
www.geolandarsweepstakes.com/
Redirect Chain
  • https://campaign.rtm.com/realtimesocial/share.aspx?promotionId=10892&shareGuid=5c42ceda-5443-492f-934b-0535d518370f
  • https://www.geolandarsweepstakes.com/?shareClickGuid=0e0df09e-4262-47c0-8955-08974f6c41e1
5 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.geolandarsweepstakes.com/?shareClickGuid=0e0df09e-4262-47c0-8955-08974f6c41e1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.31.106 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0374f52d2105018c324fa34d9528b461364d5bea9d732672e0266ce6051f8221
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://campaign.rtm.com
Referer
https://campaign.rtm.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control
max-age=15
cf-ray
8d2927160c96375f-MXP
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Mon, 14 Oct 2024 17:05:10 GMT
expires
Mon, 14 Oct 2024 17:05:25 GMT
referrer-policy
same-origin
server
cloudflare
vary
Accept-Encoding
x-frame-options
SAMEORIGIN

Redirect headers

cache-control
private
cf-cache-status
DYNAMIC
cf-ray
8d2927026ccd0f66-MXP
content-type
text/html; charset=utf-8
date
Mon, 14 Oct 2024 17:05:07 GMT
location
https://www.geolandarsweepstakes.com/?shareClickGuid=0e0df09e-4262-47c0-8955-08974f6c41e1
server
cloudflare
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
favicon.ico
campaign.rtm.com/ 		6 KB
6 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://campaign.rtm.com/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.192.75 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://campaign.rtm.com/realtimesocial/share.aspx?promotionId=10892&shareGuid=5c42ceda-5443-492f-934b-0535d518370f

Response headers

cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
referrer-policy
same-origin
cf-ray
8d2927026cd00f66-MXP
expires
Thu, 01 Jan 1970 00:00:01 GMT
content-length
6334
date
Mon, 14 Oct 2024 17:05:07 GMT
content-type
text/html; charset=UTF-8
server
cloudflare
x-frame-options
SAMEORIGIN
8d2926fdbf690f66
campaign.rtm.com/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame 384F 		0
628 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://campaign.rtm.com/cdn-cgi/challenge-platform/h/b/jsd/r/8d2926fdbf690f66
Requested by
Host: campaign.rtm.com
URL: https://campaign.rtm.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.192.75 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type
application/json
Referer

Response headers

cf-ray
8d29270be8de0f66-MXP
content-length
0
date
Mon, 14 Oct 2024 17:05:10 GMT
content-type
text/plain; charset=UTF-8
server
cloudflare
cf.errors.css
www.geolandarsweepstakes.com/cdn-cgi/styles/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
www.geolandarsweepstakes.com
URL
https://www.geolandarsweepstakes.com/cdn-cgi/styles/cf.errors.css

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Domain/Path Name / Value
campaign.rtm.com/realtimesocial Name:
Value: testcookie
.rtm.com/ Name: __cf_bm
Value: dTP_xk5tZ6dfUBBDmEyLEV6QNp0gs_peLX0BQt1ViVo-1728925506-1.0.1.1-90VYEh3TkhfK4wfCJkhgrO6awX.UOxUI8yzIxjXgKs1ysBjxG0Z127CNEat90GCEyMngrCxEjQ4NKTSn8V17Ew
.geolandarsweepstakes.com/ Name: __cf_bm
Value: akjVoYUtxsdNDfk_E1JgnoLZNi3MbO2lDOFROSySQA4-1728925510-1.0.1.1-BlqYyW6it5aCL95cAwlv4j6fGcmAdKFSQ3TidGQO2Q4vaV9tFxl2iFvyeOKDTpEoDZxoGVqv985jCNQQH2TMcA
.rtm.com/ Name: cf_clearance
Value: wyRZddqWUzt_N3sVKzLy3aAlrBw.ZJDsZ1Yh_APA4GI-1728925510-1.2.1.1-fGqu_9Vv6vf0gYMmu9ULu5zZY.mnyziNt0etASFoY_HL3XjN4qG5kN0sHHG3l6OnP5IF13dzxx.pqXIV806ExMy_Nf2Mfso91TUXv_cVoGJEFXFTjjqc6_DZ_K0h_HTaal8aRosGLj4ErTta.xmQMF4lhl_BjoR8t3TS7qz8K2KmKFop6mm0FkMS.BvCIkQf38Fxm5dIIBlioMEVYrFz8385F_TOqd.gqTgT1y3awJbDA8UmlsuFjHqNLMrhQR0Kmi8N5pAdXrJybrt6W4bdIqoidO6Bo6ehgsWYYTaQkS3cgV4YyV57ay92By8V5qhykZep.3tdBbFVIQKeqGSUli.5atusNTB6ZJrD8_4Pjo91kifGfVXAp86KwHUb35_z

2 Console Messages

Source Level URL
Text
network error URL: https://campaign.rtm.com/favicon.ico
Message:
Failed to load resource: the server responded with a status of 502 ()
network error URL: https://www.geolandarsweepstakes.com/?shareClickGuid=0e0df09e-4262-47c0-8955-08974f6c41e1
Message:
Failed to load resource: the server responded with a status of 403 ()