urlscan.io logo urlscan.io
SecurityTrails logo

lhlzw.icu Open in urlscan Pro
2606:4700:3034::ac43:ccd2  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://cutt.ly/keJ4wh8N?pwD=1hW8eTPdjv
Effective URL: https://lhlzw.icu/366d8/NDJ8IyRfJG9-Q/HF0I2U5XjExeF89YyM/xIypeIX5uMl5kJWUjJHwlL/18hX343Zyo3XzNAfmleYSRyeSR8IT8qfg2
Submission Tags: @phish_report
Submission: On November 22 via api from FI — Scanned from FI
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 6 HTTP transactions. The main IP is 2606:4700:3034::ac43:ccd2, located in United States and belongs to CLOUDFLARENET, US. The main domain is lhlzw.icu.
TLS certificate: Issued by WE1 on November 13th 2024. Valid for: 3 months.
This is the only time lhlzw.icu was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 2606:4700:10:... 13335 (CLOUDFLAR...)
1 2 2606:4700:303... 13335 (CLOUDFLAR...)
1 2a04:4e42::649 54113 (FASTLY)
4 172.67.204.210 13335 (CLOUDFLAR...)
6 3
Apex Domain
Subdomains		 Transfer
6 lhlzw.icu
lhlzw.icu
81 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 847
30 KB
1 cutt.ly
cutt.ly — Cisco Umbrella Rank: 42920
424 B
6 3
Domain Requested by
6 lhlzw.icu 1 redirects lhlzw.icu
1 code.jquery.com lhlzw.icu
1 cutt.ly 1 redirects
6 3

This site contains no links.

Subject Issuer Validity Valid
lhlzw.icu
WE1		 2024-11-13 -
2025-02-11		 3 months crt.sh
*.jquery.com
Sectigo ECC Domain Validation Secure Server CA		 2024-06-25 -
2025-06-25		 a year crt.sh

This page contains 1 frames:

Primary Page: https://lhlzw.icu/366d8/NDJ8IyRfJG9-Q/HF0I2U5XjExeF89YyM/xIypeIX5uMl5kJWUjJHwlL/18hX343Zyo3XzNAfmleYSRyeSR8IT8qfg2
Frame ID: DDC10A1D87A95AEE45C2808288BD323D
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Loading...

Page URL History Show full URLs

  1. https://cutt.ly/keJ4wh8N?pwD=1hW8eTPdjv HTTP 301
    https://lhlzw.icu/whale?girl=0d4297deab763bc9921lj&fh=23 HTTP 302
    https://lhlzw.icu/366d8/NDJ8IyRfJG9-Q/HF0I2U5XjExeF89YyM/xIypeIX5uMl5kJWUjJHwlL/18hX343Zyo3XzN... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

6
Requests

100 %
HTTPS

75 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

109 kB
Transfer

322 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://cutt.ly/keJ4wh8N?pwD=1hW8eTPdjv HTTP 301
    https://lhlzw.icu/whale?girl=0d4297deab763bc9921lj&fh=23 HTTP 302
    https://lhlzw.icu/366d8/NDJ8IyRfJG9-Q/HF0I2U5XjExeF89YyM/xIypeIX5uMl5kJWUjJHwlL/18hX343Zyo3XzNAfmleYSRyeSR8IT8qfg2 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request 18hX343Zyo3XzNAfmleYSRyeSR8IT8qfg2
lhlzw.icu/366d8/NDJ8IyRfJG9-Q/HF0I2U5XjExeF89YyM/xIypeIX5uMl5kJWUjJHwlL/
Redirect Chain
  • https://cutt.ly/keJ4wh8N?pwD=1hW8eTPdjv
  • https://lhlzw.icu/whale?girl=0d4297deab763bc9921lj&fh=23
  • https://lhlzw.icu/366d8/NDJ8IyRfJG9-Q/HF0I2U5XjExeF89YyM/xIypeIX5uMl5kJWUjJHwlL/18hX343Zyo3XzNAfmleYSRyeSR8IT8qfg2
1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://lhlzw.icu/366d8/NDJ8IyRfJG9-Q/HF0I2U5XjExeF89YyM/xIypeIX5uMl5kJWUjJHwlL/18hX343Zyo3XzNAfmleYSRyeSR8IT8qfg2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:ccd2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
2422fa7e607eb83cf09c05e431fe7f1aba563489246bf9822b857e9b2344997e

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
private
cf-cache-status
DYNAMIC
cf-ray
8e6a69aa2c990b65-OSL
content-encoding
zstd
content-type
text/html; charset=utf-8
date
Fri, 22 Nov 2024 16:49:26 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QENP8DeApas8HAHLvQ0LKxgAKd8vz3kc6b%2FJnv80oZa8FqJN2qmTfrp%2BwGYQBugPRrtSWwwiIuTYphdpIBLavyaYDRMcpJSxoO226C3iLxNTHJQpRFDanOHpq5zFP%2B3PZlggyVTbcGs%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=TCP&rtt=68600&sent=13&recv=16&lost=0&retrans=0&sent_bytes=5031&recv_bytes=2503&delivery_rate=59352&cwnd=256&unsent_bytes=0&cid=789e6878e46aaa2b&ts=2190&x=0"
vary
Accept-Encoding
x-powered-by
ASP.NET

Redirect headers

alt-svc
h3=":443"; ma=86400
cache-control
private
cf-cache-status
DYNAMIC
cf-ray
8e6a69a03ff60b65-OSL
content-type
text/html; charset=utf-8
date
Fri, 22 Nov 2024 16:49:26 GMT
location
/366d8/NDJ8IyRfJG9-Q/HF0I2U5XjExeF89YyM/xIypeIX5uMl5kJWUjJHwlL/18hX343Zyo3XzNAfmleYSRyeSR8IT8qfg2
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wo3%2BGKE0ugHfOPTMmo4VdrYp3Lm%2FTTdiUQ4E3iSOs784CrprfboWz0zk1dFOrPTmPCOyfAhuT8DxVBQmaOKTm9xijKVV5OE42MN62fx8Y9lQGbb75bDPhAz4hgZ9AbgH27KnhDacdGE%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=TCP&rtt=68855&sent=9&recv=12&lost=0&retrans=0&sent_bytes=3978&recv_bytes=2331&delivery_rate=56807&cwnd=253&unsent_bytes=0&cid=789e6878e46aaa2b&ts=1592&x=0"
x-powered-by
ASP.NET
jquery-3.0.0.min.js
code.jquery.com/ 		84 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.0.0.min.js
Requested by
Host: lhlzw.icu
URL: https://lhlzw.icu/366d8/NDJ8IyRfJG9-Q/HF0I2U5XjExeF89YyM/xIypeIX5uMl5kJWUjJHwlL/18hX343Zyo3XzNAfmleYSRyeSR8IT8qfg2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
266bcea0bb58b26aa5b16c5aee60d22ccc1ae9d67daeb21db6bad56119c3447d

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer
https://lhlzw.icu/

Response headers

content-encoding
gzip
etag
W/"28feccc0-15145"
age
2683785
x-cache
HIT, HIT
date
Fri, 22 Nov 2024 16:49:26 GMT
content-type
application/javascript; charset=utf-8
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
x-cache-hits
47597, 9867
x-served-by
cache-lga21932-LGA, cache-hel1410020-HEL
vary
Accept-Encoding
cache-control
public, max-age=31536000, stale-while-revalidate=604800
x-timer
S1732294167.783813,VS0,VE0
cross-origin-resource-policy
cross-origin
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
29995
server
nginx
iV8ISMmfE4kfnMzZCUkYzc0IUAxcl8kfDJeJXMqNzleXm9-X19qfEokfi9OX2E1
lhlzw.icu/366d8/Q3xQKmcqfnQxc2VtQH4hLyp-Q/EFzIz98JF5zXioyc3x1XiQqMiUxbT09ISMjL/yNAI34lQUAhJSRlJXQkdXM3bV5DaSFBX2YjYW9eb/ 		157 KB
36 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://lhlzw.icu/366d8/Q3xQKmcqfnQxc2VtQH4hLyp-Q/EFzIz98JF5zXioyc3x1XiQqMiUxbT09ISMjL/yNAI34lQUAhJSRlJXQkdXM3bV5DaSFBX2YjYW9eb/iV8ISMmfE4kfnMzZCUkYzc0IUAxcl8kfDJeJXMqNzleXm9-X19qfEokfi9OX2E1
Requested by
Host: lhlzw.icu
URL: https://lhlzw.icu/366d8/NDJ8IyRfJG9-Q/HF0I2U5XjExeF89YyM/xIypeIX5uMl5kJWUjJHwlL/18hX343Zyo3XzNAfmleYSRyeSR8IT8qfg2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.204.210 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer
https://lhlzw.icu/366d8/NDJ8IyRfJG9-Q/HF0I2U5XjExeF89YyM/xIypeIX5uMl5kJWUjJHwlL/18hX343Zyo3XzNAfmleYSRyeSR8IT8qfg2

Response headers

cache-control
private
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
gzip
cf-cache-status
DYNAMIC
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xjIKxCDRPO5PyEcWqkksJ9j3NwSZDQpF3jowZybnqNqe1xzqvK%2BVpK%2BN7nN4LXTQ88NeuOudWzdLa3JMVn5VVJumZgpxs6pfAzTZIENyq2gYjfHFq3PJ50TvLQE%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8e6a69adee3f7129-OSL
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=61509&sent=12&recv=12&lost=0&retrans=0&sent_bytes=4231&recv_bytes=5894&delivery_rate=323&cwnd=12000&unsent_bytes=0&cid=29a26093771f07a2&ts=1205&x=1", cfHdrFlush;dur=0
content-length
36482
date
Fri, 22 Nov 2024 16:49:27 GMT
content-type
text/css; charset=utf-8
vary
Accept-Encoding
x-powered-by
ASP.NET
server
cloudflare
Hw0fCpAfCUkbSV3dC9hI2UvSkElcnwkIyUqJF4jbSNzX24hakAyPTcvIUpefiQ1
lhlzw.icu/366d8/ajFzflAhXn4lZWE3XnVtMXwy/IUEzY0BKZ18qaV9zI0AqJTIkYnQhdSoqJmEl/TiNeIXR-XypAczJeOX58ZD1AXjFvXyRvfk58fiQjXj9zJDYqd/ 		71 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://lhlzw.icu/366d8/ajFzflAhXn4lZWE3XnVtMXwy/IUEzY0BKZ18qaV9zI0AqJTIkYnQhdSoqJmEl/TiNeIXR-XypAczJeOX58ZD1AXjFvXyRvfk58fiQjXj9zJDYqd/Hw0fCpAfCUkbSV3dC9hI2UvSkElcnwkIyUqJF4jbSNzX24hakAyPTcvIUpefiQ1
Requested by
Host: lhlzw.icu
URL: https://lhlzw.icu/366d8/NDJ8IyRfJG9-Q/HF0I2U5XjExeF89YyM/xIypeIX5uMl5kJWUjJHwlL/18hX343Zyo3XzNAfmleYSRyeSR8IT8qfg2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.204.210 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
e3e5f35d586c0e6a9a9d7187687be087580c40a5f8d0e52f0c4053bbc25c98db

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer
https://lhlzw.icu/366d8/NDJ8IyRfJG9-Q/HF0I2U5XjExeF89YyM/xIypeIX5uMl5kJWUjJHwlL/18hX343Zyo3XzNAfmleYSRyeSR8IT8qfg2

Response headers

cache-control
private
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
gzip
cf-cache-status
DYNAMIC
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lVrpp37p6JmBytSStmr1SNvxSsBS6cQucPNRZdVs797r%2BeNzTmiiqoxailgr8jJZy7nREgvsCE%2Bjd3gjYK1VQTDtPwX9wSplg8xiXJkXkc%2Fa2pbIePYDHdS3wPc%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8e6a69adee427129-OSL
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=61941&sent=45&recv=29&lost=0&retrans=0&sent_bytes=42200&recv_bytes=6626&delivery_rate=335854&cwnd=24000&unsent_bytes=0&cid=29a26093771f07a2&ts=2287&x=1", cfHdrFlush;dur=0
content-length
31699
date
Fri, 22 Nov 2024 16:49:28 GMT
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
x-powered-by
ASP.NET
server
cloudflare
iF6MXFiZV9-I2cjejM3IWMvfCUqbiMqXkAlZSF4ZjQqfHl4JDB8akAqZnxkLiFvMkB8Y18jJA2.gif
lhlzw.icu/366d8/N35eQGclaXF-KiF-XyVjZGNebiElXip/efiR-NjIkIyUkPz1fIUBsQEAwX34wcmEjX0Bzc2d8X/mlkfl5zfCUqZCRpMSQ0Ml4kYyM5IzIqYS8xLSF-dzgvaTd-I2wke/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lhlzw.icu/366d8/N35eQGclaXF-KiF-XyVjZGNebiElXip/efiR-NjIkIyUkPz1fIUBsQEAwX34wcmEjX0Bzc2d8X/mlkfl5zfCUqZCRpMSQ0Ml4kYyM5IzIqYS8xLSF-dzgvaTd-I2wke/iF6MXFiZV9-I2cjejM3IWMvfCUqbiMqXkAlZSF4ZjQqfHl4JDB8akAqZnxkLiFvMkB8Y18jJA2.gif
Requested by
Host: lhlzw.icu
URL: https://lhlzw.icu/366d8/NDJ8IyRfJG9-Q/HF0I2U5XjExeF89YyM/xIypeIX5uMl5kJWUjJHwlL/18hX343Zyo3XzNAfmleYSRyeSR8IT8qfg2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.204.210 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
c9c616de646e94b9adea60ef1e8ffe5246f82b82baa1e039b1b6007067791773

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer
https://lhlzw.icu/366d8/NDJ8IyRfJG9-Q/HF0I2U5XjExeF89YyM/xIypeIX5uMl5kJWUjJHwlL/18hX343Zyo3XzNAfmleYSRyeSR8IT8qfg2

Response headers

cf-cache-status
MISS
etag
"efafebe7f734db1:0"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GVSC7cPOp1%2BY7gy5BhjGRnkHqg%2BK%2Fzb8RZRLkROJXUCrQIoKBpDnWrV3spIT06BLm7tCk407ZgM63uvZoRmarawc3THYWnhaLk%2FOVN%2Btop8C8IPYlPTSWl6IYTM%3D"}],"group":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=61941&sent=60&recv=29&lost=0&retrans=0&sent_bytes=59335&recv_bytes=6626&delivery_rate=335854&cwnd=24000&unsent_bytes=0&cid=29a26093771f07a2&ts=2289&x=1", cfHdrFlush;dur=0
date
Fri, 22 Nov 2024 16:49:28 GMT
content-type
image/gif
last-modified
Tue, 12 Nov 2024 11:42:09 GMT
vary
Accept-Encoding
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8e6a69adee457129-OSL
accept-ranges
bytes
content-length
8942
x-powered-by
ASP.NET
server
cloudflare
favicon.ico
lhlzw.icu/ 		1 KB
1 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://lhlzw.icu/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.204.210 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
58d64bad8f43a6c332a2e1639a566bd482c812b3f892d4aba9ae15be8d06eb8f

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer
https://lhlzw.icu/366d8/NDJ8IyRfJG9-Q/HF0I2U5XjExeF89YyM/xIypeIX5uMl5kJWUjJHwlL/18hX343Zyo3XzNAfmleYSRyeSR8IT8qfg2

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
zstd
cf-cache-status
MISS
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PS8rFNQHeX8lQfRf1eM4u2SG32YOVg39PxgBb%2F4%2F%2BSUWcTmPQxdB1dWH5KW38cF3p3%2BmZK8CMgoB64oRRKs1XKWh2QpRZlifJbGj8qGKkoMysMZhg5vNJUH4%2Bgw%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8e6a69b9c98c7129-OSL
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=62033&sent=84&recv=50&lost=0&retrans=0&sent_bytes=85072&recv_bytes=7983&delivery_rate=219521&cwnd=40800&unsent_bytes=0&cid=29a26093771f07a2&ts=4105&x=1", cfHdrFlush;dur=0
date
Fri, 22 Nov 2024 16:49:30 GMT
content-type
text/html
x-powered-by
ASP.NET
vary
Accept-Encoding
server
cloudflare

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery

3 Cookies

Domain/Path Name / Value
cutt.ly/ Name: PHPSESSID
Value: h1cot3qk9orrqkni7985sd5qqm
lhlzw.icu/ Name: b59f56
Value: 1
lhlzw.icu/ Name: ASP.NET_SessionId
Value: jc5lbd5h3hwvfi1s34s3ryvu

1 Console Messages

Source Level URL
Text
network error URL: https://lhlzw.icu/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 ()