Submitted URL: http://removeriba.com/
Effective URL: https://removeriba.com/
Submission Tags: suspect
Submission: On December 26 via api from BR — Scanned from DE

Summary

This website contacted 6 IPs in 2 countries across 5 domains to perform 8 HTTP transactions. The main IP is 2607:ff18:80::7943, located in United States and belongs to GRIDFURY-AS, US. The main domain is removeriba.com.
TLS certificate: Issued by E5 on December 25th 2024. Valid for: 3 months.
This is the only time removeriba.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2607:ff18:80:... 40630 (GRIDFURY-AS)
1 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 172.67.34.118 13335 (CLOUDFLAR...)
3 142.250.185.99 15169 (GOOGLE)
8 6
Apex Domain
Subdomains
Transfer
3 gstatic.com
fonts.gstatic.com
53 KB
2 statcounter.com
www.statcounter.com — Cisco Umbrella Rank: 19002
c.statcounter.com — Cisco Umbrella Rank: 11933
13 KB
1 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 318
12 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 29
1 KB
1 removeriba.com
removeriba.com
13 KB
8 5
Domain Requested by
3 fonts.gstatic.com fonts.googleapis.com
1 c.statcounter.com www.statcounter.com
1 www.statcounter.com removeriba.com
1 cdn.jsdelivr.net removeriba.com
1 fonts.googleapis.com removeriba.com
1 removeriba.com
8 6

This site contains links to these domains. Also see Links.

Domain
www.paypal.com
islamqa.info
Subject Issuer Validity Valid
removeriba.com
E5
2024-12-25 -
2025-03-25
3 months crt.sh
upload.video.google.com
WR2
2024-12-02 -
2025-02-24
3 months crt.sh
*.jsdelivr.net
Sectigo RSA Domain Validation Secure Server CA
2024-05-04 -
2025-05-04
a year crt.sh
statcounter.com
Sectigo RSA Domain Validation Secure Server CA
2024-12-16 -
2025-12-16
a year crt.sh
*.gstatic.com
WR2
2024-12-02 -
2025-02-24
3 months crt.sh

This page contains 1 frames:

Primary Page: https://removeriba.com/
Frame ID: 2BFC180AEA3FED080B67A87CADB633D0
Requests: 10 HTTP requests in this frame

Screenshot

Page Title

Remove Riba: Dispose Unlawful Wealth

Page URL History Show full URLs

  1. http://removeriba.com/ HTTP 307
    https://removeriba.com/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Overall confidence: 100%
Detected patterns
  • statcounter\.com/counter/counter

Overall confidence: 100%
Detected patterns
  • <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
  • //cdn\.jsdelivr\.net/

Page Statistics

8
Requests

100 %
HTTPS

60 %
IPv6

5
Domains

6
Subdomains

6
IPs

2
Countries

92 kB
Transfer

188 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://removeriba.com/ HTTP 307
    https://removeriba.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
removeriba.com/
Redirect Chain
  • http://removeriba.com/
  • https://removeriba.com/
20 KB
13 KB
Document
General
Full URL
https://removeriba.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2607:ff18:80::7943 , United States, ASN40630 (GRIDFURY-AS, US),
Reverse DNS
Software
Apache /
Resource Hash
ea3addc0ad0a3ecbf26d87f77f7ee530655a696fb3bf1744282066509772b53c

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Android 13; Mobile; rv:112.0) Gecko/112.0 Firefox/112.0

Response headers

accept-ranges
bytes
content-encoding
gzip
content-length
12810
content-type
text/html; charset=UTF-8
date
Thu, 26 Dec 2024 15:02:41 GMT
etag
"4e67-62a2bae548940"
last-modified
Thu, 26 Dec 2024 12:42:37 GMT
server
Apache
vary
Accept-Encoding
via
e9s

Redirect headers

Location
https://removeriba.com/
Non-Authoritative-Reason
HttpsUpgrades
css2
fonts.googleapis.com/
10 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css2?family=Fira+Sans:ital,wght@0,400;0,500;0,600;1,400&display=swap
Requested by
Host: removeriba.com
URL: https://removeriba.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
e6425f350416c0359d8ca4364c8ff0558c7981b69cba9cba44b71b82dcffcd10
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Android 13; Mobile; rv:112.0) Gecko/112.0 Firefox/112.0
Referer
https://removeriba.com/

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Thu, 26 Dec 2024 15:02:41 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 26 Dec 2024 15:02:41 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
pico.classless.amber.min.css
cdn.jsdelivr.net/npm/@picocss/pico@2/css/
69 KB
12 KB
Stylesheet
General
Full URL
https://cdn.jsdelivr.net/npm/@picocss/pico@2/css/pico.classless.amber.min.css
Requested by
Host: removeriba.com
URL: https://removeriba.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:bb1f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
95f7bc3abd0d3f37da45cd8168376ef1cff0509e3d5af023f8c4f9c8002eb7c6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (Android 13; Mobile; rv:112.0) Gecko/112.0 Firefox/112.0
Referer
https://removeriba.com/

Response headers

access-control-expose-headers
*
content-encoding
br
cf-cache-status
HIT
etag
W/"1122f-NU3gkJjhyA3Fij9mmBCP5XVbXqM"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FaTF5PkAA0xxiWySEhXkflWTT0D3MOONaZQCSkPx%2B%2FhZgsC4NSCPaQQR30q5XgedQlnWLihPj4BvnTNOfsmPhIlsFgqPr1%2Bh52iCo08VivaAXG2wdT6v5RmSq5iwk71G8m%2FEaztQgkc9TgQsCAs%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
x-jsd-version-type
version
alt-svc
h3=":443"; ma=86400
x-cache
HIT, HIT
date
Thu, 26 Dec 2024 15:02:41 GMT
content-type
text/css; charset=utf-8
x-served-by
cache-fra-etou8220133-FRA, cache-lga21946-LGA
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=604800, s-maxage=43200
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
8f81f40e78cfd3ac-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
11358
server
cloudflare
x-jsd-version
2.0.6
counter.js
www.statcounter.com/counter/
35 KB
13 KB
Script
General
Full URL
https://www.statcounter.com/counter/counter.js
Requested by
Host: removeriba.com
URL: https://removeriba.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.34.118 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
608242c41714bcf0ce0c6dc6befbfbd8a4c4fa6c97d88f5deec2f5238ba3e3fc

Request headers

User-Agent
Mozilla/5.0 (Android 13; Mobile; rv:112.0) Gecko/112.0 Firefox/112.0
Referer
https://removeriba.com/

Response headers

cache-control
max-age=43200
content-encoding
gzip
cf-cache-status
HIT
etag
W/"6768f8c8-8a98"
age
28517
cf-ray
8f81f40e8a81915f-FRA
expires
Thu, 26 Dec 2024 19:07:24 GMT
date
Thu, 26 Dec 2024 15:02:41 GMT
content-type
application/javascript
vary
Accept-Encoding
server
cloudflare
last-modified
Mon, 23 Dec 2024 05:44:40 GMT
truncated
/
3 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
494f3f7a8b2c3688552025910e7b057b1ed64f39b5f02fa50e9e1da8594009b4

Request headers

User-Agent
Mozilla/5.0 (Android 13; Mobile; rv:112.0) Gecko/112.0 Firefox/112.0
Referer

Response headers

Content-Type
image/svg+xml
va9E4kDNxMZdWfMOD5Vvl4jLazX3dA.woff2
fonts.gstatic.com/s/firasans/v17/
17 KB
17 KB
Font
General
Full URL
https://fonts.gstatic.com/s/firasans/v17/va9E4kDNxMZdWfMOD5Vvl4jLazX3dA.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Fira+Sans:ital,wght@0,400;0,500;0,600;1,400&display=swap
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.99 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s49-in-f3.1e100.net
Software
sffe /
Resource Hash
291434574a5f00792889e946960ce6f00b87a1af6373192fbb797c74c357615e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Android 13; Mobile; rv:112.0) Gecko/112.0 Firefox/112.0
Origin
https://removeriba.com
Referer
https://fonts.googleapis.com/

Response headers

age
508278
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Sat, 20 Dec 2025 17:51:23 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 20 Dec 2024 17:51:23 GMT
last-modified
Tue, 02 May 2023 14:50:09 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
17568
x-xss-protection
0
server
sffe
truncated
/
238 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b229b93105cf730d9c82453d8b7d2fe0c626e4fefe158376b3196cf5592f63c6

Request headers

User-Agent
Mozilla/5.0 (Android 13; Mobile; rv:112.0) Gecko/112.0 Firefox/112.0
Referer

Response headers

Content-Type
image/svg+xml
va9B4kDNxMZdWfMOD5VnZKveRhf6Xl7Glw.woff2
fonts.gstatic.com/s/firasans/v17/
17 KB
17 KB
Font
General
Full URL
https://fonts.gstatic.com/s/firasans/v17/va9B4kDNxMZdWfMOD5VnZKveRhf6Xl7Glw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Fira+Sans:ital,wght@0,400;0,500;0,600;1,400&display=swap
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.99 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s49-in-f3.1e100.net
Software
sffe /
Resource Hash
c4d093f1db96a91d28e3005365fadbd3a5e5472c55e84466051982d0e423f394
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Android 13; Mobile; rv:112.0) Gecko/112.0 Firefox/112.0
Origin
https://removeriba.com
Referer
https://fonts.googleapis.com/

Response headers

age
133004
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Thu, 25 Dec 2025 02:05:57 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 25 Dec 2024 02:05:57 GMT
last-modified
Tue, 02 May 2023 14:50:03 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
17756
x-xss-protection
0
server
sffe
va9C4kDNxMZdWfMOD5VvkrjJYTLVdlTO.woff2
fonts.gstatic.com/s/firasans/v17/
18 KB
18 KB
Font
General
Full URL
https://fonts.gstatic.com/s/firasans/v17/va9C4kDNxMZdWfMOD5VvkrjJYTLVdlTO.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Fira+Sans:ital,wght@0,400;0,500;0,600;1,400&display=swap
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.99 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s49-in-f3.1e100.net
Software
sffe /
Resource Hash
0574dccf64bf3d59d357524af81b92ddf62c9dc051c6df9684fbeadcab2fe8d4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Android 13; Mobile; rv:112.0) Gecko/112.0 Firefox/112.0
Origin
https://removeriba.com
Referer
https://fonts.googleapis.com/

Response headers

age
476232
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Sun, 21 Dec 2025 02:45:29 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 21 Dec 2024 02:45:29 GMT
last-modified
Tue, 02 May 2023 14:50:06 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
18396
x-xss-protection
0
server
sffe
t.php
c.statcounter.com/
192 B
594 B
XHR
General
Full URL
https://c.statcounter.com/t.php?sc_project=13072213&u1=FE5719FC66704D24AB3584C27D53A83E&java=1&security=e7c133ad&sc_snum=1&sess=7810d0&p=0&rcat=d&rdom=d&rdomg=new&bb=1&jg=new&rr=1.1.1.1.1.1.1.1.1&resolution=1600&h=1200&camefrom=&u=https%3A//removeriba.com/&t=Remove%20Riba%3A%20Dispose%20Unlawful%20Wealth&invisible=1&sc_rum_e_s=974&sc_rum_e_e=977&sc_rum_f_s=0&sc_rum_f_e=721&get_config=true
Requested by
Host: www.statcounter.com
URL: https://www.statcounter.com/counter/counter.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.34.118 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb2697b60c526a1d4980e0874700e7c2b4f43bb9292770f71bb4bb972506e415

Request headers

User-Agent
Mozilla/5.0 (Android 13; Mobile; rv:112.0) Gecko/112.0 Firefox/112.0
Referer
https://removeriba.com/

Response headers

content-encoding
br
cf-cache-status
DYNAMIC
access-control-allow-credentials
true
cf-ray
8f81f4106ba7915f-FRA
expires
Mon, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin
https://removeriba.com
p3p
policyref="http://www.statcounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"
date
Thu, 26 Dec 2024 15:02:42 GMT
content-type
application/json
server
cloudflare

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| calculate number| sc_project number| sc_invisible string| sc_security function| _statcounter

3 Cookies

Domain/Path Name / Value
.removeriba.com/ Name: sc_is_visitor_unique
Value: rx13072213.1735225362.FE5719FC66704D24AB3584C27D53A83E.1.1.1.1.1.1.1.1.1
.statcounter.com/ Name: is_unique
Value: sc13072213.1735225362.0
.statcounter.com/ Name: is_visitor_unique
Value: 1735225362353379116