removeme.za.com - urlscan.io

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 4 HTTP transactions. The main IP is 162.241.85.174, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is removeme.za.com.
TLS certificate: Issued by R11 on December 25th 2024. Valid for: 3 months.

This is the only time removeme.za.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	192.240.123.17 192.240.123.17	30058 (FDCSERVERS) (FDCSERVERS)
3	162.241.85.174 162.241.85.174	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
1	104.17.25.14 104.17.25.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2

1 192.240.123.17 (Los Angeles, United States) 1 redirects

ASN30058 (FDCSERVERS, US)

detoxpaches.ru.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 162.241.85.174 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: ish20zmb

removeme.za.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.25.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	za.com removeme.za.com	161 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 225	6 KB
1	ru.com 1 redirects detoxpaches.ru.com	327 B
4	3

	Domain	Requested by
3	removeme.za.com	removeme.za.com
1	cdnjs.cloudflare.com	removeme.za.com
1	detoxpaches.ru.com	1 redirects
4	3

This site contains no links.

Subject Issuer	Validity	Valid
cpcalendars.removeme.za.com R11	`2024-12-25` - `2025-03-25`	3 months	crt.sh
cdnjs.cloudflare.com WE1	`2024-11-26` - `2025-02-24`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://removeme.za.com/unsubscribe.php?Code=sosu60c069f92966f824thwesvey
Frame ID: 2D760010BA6FE43EE559E48BAC77CC9F
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Remove Me

Page URL History Show full URLs

http://detoxpaches.ru.com/x00fMEZxXO6-vxqrBUrO870oIuk0G8HT8xaUxnJBmLo0S4qzuQ HTTP 307
https://detoxpaches.ru.com/x00fMEZxXO6-vxqrBUrO870oIuk0G8HT8xaUxnJBmLo0S4qzuQ HTTP 307
http://detoxpaches.ru.com/x00fMEZxXO6-vxqrBUrO870oIuk0G8HT8xaUxnJBmLo0S4qzuQ HTTP 302
https://removeme.za.com/unsubscribe.php?Code=sosu60c069f92966f824thwesvey Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

167 kB
Transfer

194 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://detoxpaches.ru.com/x00fMEZxXO6-vxqrBUrO870oIuk0G8HT8xaUxnJBmLo0S4qzuQ HTTP 307
https://detoxpaches.ru.com/x00fMEZxXO6-vxqrBUrO870oIuk0G8HT8xaUxnJBmLo0S4qzuQ HTTP 307
http://detoxpaches.ru.com/x00fMEZxXO6-vxqrBUrO870oIuk0G8HT8xaUxnJBmLo0S4qzuQ HTTP 302
https://removeme.za.com/unsubscribe.php?Code=sosu60c069f92966f824thwesvey Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request unsubscribe.php Show response
removeme.za.com/
Redirect Chain

http://detoxpaches.ru.com/x00fMEZxXO6-vxqrBUrO870oIuk0G8HT8xaUxnJBmLo0S4qzuQ
https://detoxpaches.ru.com/x00fMEZxXO6-vxqrBUrO870oIuk0G8HT8xaUxnJBmLo0S4qzuQ
http://detoxpaches.ru.com/x00fMEZxXO6-vxqrBUrO870oIuk0G8HT8xaUxnJBmLo0S4qzuQ
https://removeme.za.com/unsubscribe.php?Code=sosu60c069f92966f824thwesvey

5 KB
2 KB

1822ms
193ms

Document
text/html

162.241.85.174
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://removeme.za.com/unsubscribe.php?Code=sosu60c069f92966f824thwesvey
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.241.85.174 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: ish20zmb
Software: Apache /
Resource Hash: a1bac344d81897ffdf19272a67620c0ef3a4b83c1e1ea60f14a8c9ae90e9d159

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2076
content-type: text/html; charset=UTF-8
date: Sun, 29 Dec 2024 08:03:41 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding

Redirect headers

Connection: Keep-Alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Sun, 29 Dec 2024 08:03:39 GMT
Keep-Alive: timeout=5, max=100
Location: https://removeme.za.com/unsubscribe.php?Code=sosu60c069f92966f824thwesvey
Server: Apache/2.4.6 (CentOS) PHP/5.4.16
X-Powered-By: PHP/5.4.16

GET
H3 200 font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ 30 KB
6 KB 43ms
24ms Stylesheet
text/css 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css

Requested by

Host: removeme.za.com
URL: https://removeme.za.com/unsubscribe.php?Code=sosu60c069f92966f824thwesvey

Protocol

H3

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://removeme.za.com/

Response headers

cf-cdnjs-via: cfworker/kv
content-encoding: br
cf-cache-status: HIT
etag: "5eb03e5f-7918"
age: 175583
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l6a3gXdzzAiSbGj6xodub9Nf2iZwGyrRe4mWOYOKGuVPK757zmQLOmbvFEZKgyF9eCVxWuOoZmuiFOBSf9TayjJHV5mK7vyZucmLOzaORVc4lBOE7pUNtT%2FOuQNHumNnq08YdO0n"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Fri, 19 Dec 2025 08:03:41 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sun, 29 Dec 2024 08:03:41 GMT
content-type: text/css; charset=utf-8
last-modified: Mon, 04 May 2020 16:10:07 GMT
vary: Accept-Encoding
priority: u=0,i=?0
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 8f98466748b7c291-VIE
accept-ranges: bytes
access-control-allow-origin: *
content-length: 5631
server: cloudflare

GET
H2 200 unsiubd.jpg
removeme.za.com/img/ 157 KB
157 KB 348ms
348ms Image
image/jpeg 162.241.85.174
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://removeme.za.com/img/unsiubd.jpg
Requested by: Host: removeme.za.com
URL: https://removeme.za.com/unsubscribe.php?Code=sosu60c069f92966f824thwesvey
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.241.85.174 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: ish20zmb
Software: Apache /
Resource Hash: 6f399665493f92edb5efc3c26505431e2364d900c0b1409472ee6c4487a58b62

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://removeme.za.com/unsubscribe.php?Code=sosu60c069f92966f824thwesvey

Response headers

accept-ranges: bytes
content-length: 160487
date: Sun, 29 Dec 2024 08:03:41 GMT
last-modified: Sat, 21 Oct 2023 11:04:53 GMT
content-type: image/jpeg
server: Apache

GET
H2 200 icons8-shorten-urls-48.png
removeme.za.com/ 2 KB
2 KB 182ms
182ms Other
image/png 162.241.85.174
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://removeme.za.com/icons8-shorten-urls-48.png
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.241.85.174 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: ish20zmb
Software: Apache /
Resource Hash: 915ee548a3d64ccb93ec346263e97d8f81dbc2db250383577b6131e4d63ba513

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://removeme.za.com/unsubscribe.php?Code=sosu60c069f92966f824thwesvey

Response headers

accept-ranges: bytes
content-length: 1610
date: Sun, 29 Dec 2024 08:03:42 GMT
last-modified: Fri, 20 Oct 2023 08:15:31 GMT
content-type: image/png
server: Apache

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			removeme.za.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 6ce6cce9b5749411c41565e1973de21c

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
detoxpaches.ru.com
removeme.za.com
104.17.25.14
162.241.85.174
192.240.123.17
6f399665493f92edb5efc3c26505431e2364d900c0b1409472ee6c4487a58b62
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
915ee548a3d64ccb93ec346263e97d8f81dbc2db250383577b6131e4d63ba513
a1bac344d81897ffdf19272a67620c0ef3a4b83c1e1ea60f14a8c9ae90e9d159

removeme.za.com Open in urlscan Pro 162.241.85.174 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

4 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

2 IPs

2 Countries

167 kBTransfer

194 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

1 Cookies

Indicators

removeme.za.com Open in urlscan Pro
162.241.85.174 Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

167 kB
Transfer

194 kB
Size

1
Cookies

4 HTTP transactions
0 data transactions