spoofmail.tucot9.com Open in urlscan Pro
2a0e:97c0:3e3:8a7::1 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://spoofmail.tucot9.com/
Effective URL:
https://spoofmail.tucot9.com/
Submission: On December 24 via api (December 24th 2024, 8:29:32 pm UTC) from US — Scanned from CA

Summary HTTP 8 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 8 HTTP transactions. The main IP is 2a0e:97c0:3e3:8a7::1, located in Vaduz, Liechtenstein and belongs to FlorianKolb Florian Kolb, DE. The main domain is spoofmail.tucot9.com.
TLS certificate: Issued by R11 on December 3rd 2024. Valid for: 3 months.

This is the only time spoofmail.tucot9.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
6	2a0e:97c0:3e3... 2a0e:97c0:3e3:8a7::1	58087 (FlorianKo...) (FlorianKolb Florian Kolb)
1	2607:f8b0:400... 2607:f8b0:400d:c07::5f	15169 (GOOGLE) (GOOGLE)
1	173.194.66.94 173.194.66.94	15169 (GOOGLE) (GOOGLE)
8	3

6 2a0e:97c0:3e3:8a7::1 (Vaduz, Liechtenstein)

ASN58087 (FlorianKolb Florian Kolb, DE)

spoofmail.tucot9.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:400d:c07::5f (Morganton, United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 173.194.66.94 (United States)

ASN15169 (GOOGLE, US)
PTR: qo-in-f94.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	tucot9.com spoofmail.tucot9.com	5 KB
1	gstatic.com fonts.gstatic.com	11 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 29	775 B
8	3

	Domain	Requested by
6	spoofmail.tucot9.com	spoofmail.tucot9.com
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	spoofmail.tucot9.com
8	3

This site contains links to these domains. Also see Links.

Domain
t9selling.mysellix.io

Subject Issuer	Validity	Valid
spoofmail.tucot9.com R11	`2024-12-03` - `2025-03-03`	3 months	crt.sh
upload.video.google.com WR2	`2024-12-02` - `2025-02-24`	3 months	crt.sh
*.gstatic.com WR2	`2024-12-02` - `2025-02-24`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://spoofmail.tucot9.com/
Frame ID: 2270B4B8EBABC7334704D94A2F553CCF
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Spoofmail Lo

Page URL History Show full URLs

http://spoofmail.tucot9.com/ HTTP 307
https://spoofmail.tucot9.com/ Page URL

Detected technologies

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

8
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

17 kB
Transfer

26 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://t9selling.mysellix.io/
Title: Kauf ihn dir hier

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://spoofmail.tucot9.com/ HTTP 307
https://spoofmail.tucot9.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
spoofmail.tucot9.com/
Redirect Chain

http://spoofmail.tucot9.com/
https://spoofmail.tucot9.com/

2 KB
794 B

421ms
121ms

Document
text/html

2a0e:97c0:3e3:8a7::1
FlorianKolb Flori...

General

Check archive.org

Show headers Download Go to

Full URL: https://spoofmail.tucot9.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0e:97c0:3e3:8a7::1 Vaduz, Liechtenstein, ASN58087 (FlorianKolb Florian Kolb, DE),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 9ae785d08bd145113cd2c38b11d86389220a783fef5aebad91542b8959f3236a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

content-encoding: br
content-type: text/html
date: Tue, 24 Dec 2024 20:29:28 GMT
etag: W/"66cb6f33-667"
last-modified: Sun, 25 Aug 2024 17:51:47 GMT
server: nginx
x-powered-by: PleskLin

Redirect headers

Location: https://spoofmail.tucot9.com/
Non-Authoritative-Reason: HttpsUpgrades

GET
H2 200 styles.css
spoofmail.tucot9.com/ 5 KB
1 KB 152ms
150ms Stylesheet
text/css 2a0e:97c0:3e3:8a7::1
FlorianKolb Flori...

General

Check archive.org

Show headers Download Go to

Full URL: https://spoofmail.tucot9.com/styles.css
Requested by: Host: spoofmail.tucot9.com
URL: https://spoofmail.tucot9.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0e:97c0:3e3:8a7::1 Vaduz, Liechtenstein, ASN58087 (FlorianKolb Florian Kolb, DE),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: b56079b9219b5c4b33bad918a7fa6c5be9e1ffafaefc0c30534bfc5c7311ccd1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://spoofmail.tucot9.com/

Response headers

content-encoding: br
date: Tue, 24 Dec 2024 20:29:28 GMT
etag: W/"66b12366-134a"
content-type: text/css
last-modified: Mon, 05 Aug 2024 19:09:26 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 logger.js Show response
spoofmail.tucot9.com/ 1 KB
601 B 152ms
150ms Script
text/javascript 2a0e:97c0:3e3:8a7::1
FlorianKolb Flori...

General

Check archive.org

Show headers Download Go to

Full URL: https://spoofmail.tucot9.com/logger.js
Requested by: Host: spoofmail.tucot9.com
URL: https://spoofmail.tucot9.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0e:97c0:3e3:8a7::1 Vaduz, Liechtenstein, ASN58087 (FlorianKolb Florian Kolb, DE),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 8347861b8b8cec714518561570643e3d1e8ee3505bd0f6511182fdee209c82ee

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://spoofmail.tucot9.com/

Response headers

content-encoding: br
date: Tue, 24 Dec 2024 20:29:28 GMT
etag: W/"66b12ec2-416"
content-type: text/javascript
last-modified: Mon, 05 Aug 2024 19:57:54 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 dropdownmenu.js Show response
spoofmail.tucot9.com/ 5 KB
2 KB 150ms
148ms Script
text/javascript 2a0e:97c0:3e3:8a7::1
FlorianKolb Flori...

General

Check archive.org

Show headers Download Go to

Full URL: https://spoofmail.tucot9.com/dropdownmenu.js
Requested by: Host: spoofmail.tucot9.com
URL: https://spoofmail.tucot9.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0e:97c0:3e3:8a7::1 Vaduz, Liechtenstein, ASN58087 (FlorianKolb Florian Kolb, DE),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: ab0976b2900f66e6acb365f94ed2e9223d08aac89347df2900ac053ddad6f7c3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://spoofmail.tucot9.com/

Response headers

content-encoding: br
date: Tue, 24 Dec 2024 20:29:28 GMT
etag: W/"66b19402-128d"
content-type: text/javascript
last-modified: Tue, 06 Aug 2024 03:09:54 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 css2
fonts.googleapis.com/ 814 B
775 B 157ms
79ms Stylesheet
text/css 2607:f8b0:400d:c07::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Orbitron:wght@400;700&display=swap

Requested by

Host: spoofmail.tucot9.com
URL: https://spoofmail.tucot9.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c07::5f Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d183c30038355e37983b6836dba48f448ed85b3f0e571cfe6a4430f39c4c0883

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://spoofmail.tucot9.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Tue, 24 Dec 2024 20:29:28 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 24 Dec 2024 20:29:28 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Tue, 24 Dec 2024 20:29:28 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 scripts.js Show response
spoofmail.tucot9.com/ 1 KB
532 B 149ms
148ms Script
text/javascript 2a0e:97c0:3e3:8a7::1
FlorianKolb Flori...

General

Check archive.org

Show headers Download Go to

Full URL: https://spoofmail.tucot9.com/scripts.js
Requested by: Host: spoofmail.tucot9.com
URL: https://spoofmail.tucot9.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0e:97c0:3e3:8a7::1 Vaduz, Liechtenstein, ASN58087 (FlorianKolb Florian Kolb, DE),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 4d9f2611f33ffeba1a7532f4ec2ae99e9bb5214c6fca97d7674e1a6ca88b5ae4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://spoofmail.tucot9.com/

Response headers

content-encoding: br
date: Tue, 24 Dec 2024 20:29:28 GMT
etag: W/"66b11a65-4ae"
content-type: text/javascript
last-modified: Mon, 05 Aug 2024 18:31:01 GMT
server: nginx
x-powered-by: PleskLin

GET
H3 200 yMJRMIlzdpvBhQQL_Qq7dy0.woff2
fonts.gstatic.com/s/orbitron/v31/ 11 KB
11 KB 82ms
39ms Font
font/woff2 173.194.66.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/orbitron/v31/yMJRMIlzdpvBhQQL_Qq7dy0.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Orbitron:wght@400;700&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

173.194.66.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

qo-in-f94.1e100.net

Software

sffe /

Resource Hash

c4fcc67f22da96c786b0bbea125fc54ccc3be76b71daca8e2097816da162f3fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://spoofmail.tucot9.com
Referer: https://fonts.googleapis.com/

Response headers

age: 264920
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Sun, 21 Dec 2025 18:54:08 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 21 Dec 2024 18:54:08 GMT
last-modified: Thu, 24 Aug 2023 20:51:25 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 11544
x-xss-protection: 0
server: sffe

GET
H2 404 logo.png
spoofmail.tucot9.com/ 808 B
501 B 119ms
119ms Other
text/html 2a0e:97c0:3e3:8a7::1
FlorianKolb Flori...

General

Check archive.org

Show headers Download Go to

Full URL: https://spoofmail.tucot9.com/logo.png
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0e:97c0:3e3:8a7::1 Vaduz, Liechtenstein, ASN58087 (FlorianKolb Florian Kolb, DE),
Reverse DNS
Software: nginx /
Resource Hash: b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://spoofmail.tucot9.com/

Response headers

content-encoding: br
date: Tue, 24 Dec 2024 20:29:28 GMT
etag: W/"328-613781d6bd839"
content-type: text/html
last-modified: Tue, 12 Mar 2024 15:14:30 GMT
server: nginx

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| toggleDropdown function| showWarning function| animateTitle

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://spoofmail.tucot9.com/logo.png Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
spoofmail.tucot9.com
173.194.66.94
2607:f8b0:400d:c07::5f
2a0e:97c0:3e3:8a7::1
4d9f2611f33ffeba1a7532f4ec2ae99e9bb5214c6fca97d7674e1a6ca88b5ae4
8347861b8b8cec714518561570643e3d1e8ee3505bd0f6511182fdee209c82ee
9ae785d08bd145113cd2c38b11d86389220a783fef5aebad91542b8959f3236a
ab0976b2900f66e6acb365f94ed2e9223d08aac89347df2900ac053ddad6f7c3
b56079b9219b5c4b33bad918a7fa6c5be9e1ffafaefc0c30534bfc5c7311ccd1
b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187
c4fcc67f22da96c786b0bbea125fc54ccc3be76b71daca8e2097816da162f3fb
d183c30038355e37983b6836dba48f448ed85b3f0e571cfe6a4430f39c4c0883

spoofmail.tucot9.com Open in urlscan Pro 2a0e:97c0:3e3:8a7::1 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

8 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

17 kBTransfer

26 kBSize

0 Cookies

1 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

spoofmail.tucot9.com Open in urlscan Pro
2a0e:97c0:3e3:8a7::1 Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

17 kB
Transfer

26 kB
Size

0
Cookies

8 HTTP transactions
0 data transactions