botclient.gq Open in urlscan Pro
35.201.120.147  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

24 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response botclient.gq/	33 KB 33 KB	613ms 186ms	Document text/html	35.201.120.147 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://botclient.gq/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.201.120.147 , Ascension Island, ASN15169 (GOOGLE, US), Reverse DNS 147.120.201.35.bc.googleusercontent.com Software / Express Resource Hash f801c4029b906f943612585c3612ee65eb24ca4a7da152588e5702b26b1da44c Request headers :method GET :authority botclient.gq :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 access-control-allow-origin * content-type text/html; charset=utf-8 date Fri, 31 Jul 2020 08:13:11 GMT etag W/"8336-I6hCyJ1zN0r1NGW6bWUUKhgvXpY" expect-ct max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791" x-powered-by Express content-length 33590
GET H2	200	0.2d737cc92c807c265e1f.css discord.com/assets/	1 MB 185 KB	135ms 62ms	Stylesheet text/css	162.159.128.233 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://discord.com/assets/0.2d737cc92c807c265e1f.css Requested by Host: botclient.gq URL: https://botclient.gq/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 162.159.128.233 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1784e9baa97ab89c7eff52ebc50f68dc0a71d1564cdbb6121c9f3bd5eeeb9a67 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 31 Jul 2020 08:13:11 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT status 200 vary Origin, Accept-Encoding x-xss-protection 1; mode=block last-modified Thu, 04 Jun 2020 22:49:35 GMT server cloudflare x-frame-options DENY etag W/"ec58df4511f59177a23ebb23992ffdd1" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/css access-control-allow-origin https://discord.com cache-control public, max-age=2592000 cf-request-id 044587b743000015f0310da200000001 cf-ray 5bb5dbd20f8915f0-ARN
GET H2	200	jquery-3.5.1.min.js Show response code.jquery.com/	87 KB 30 KB	426ms 42ms	Script application/javascript	209.197.3.24 HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.5.1.min.js Requested by Host: botclient.gq URL: https://botclient.gq/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 209.197.3.24 Phoenix, United States, ASN20446 (HIGHWINDS3, US), Reverse DNS vip0x018.map2.ssl.hwcdn.net Software nginx / Resource Hash f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 31 Jul 2020 08:13:12 GMT content-encoding gzip last-modified Mon, 04 May 2020 23:02:39 GMT server nginx status 200 etag W/"5eb09f0f-15d84" vary Accept-Encoding x-hw 1596183192.dop068.sk1.t,1596183192.cds068.sk1.hn,1596183192.cds002.sk1.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30879
GET H2	200	e1180c171e5a54377584.js Show response q2497732f.tk/assets/	6 KB 2 KB	99ms 38ms	Fetch application/javascript	2606:4700:3031::ac43:8297 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://q2497732f.tk/assets/e1180c171e5a54377584.js Requested by Host: botclient.gq URL: https://botclient.gq/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::ac43:8297 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9fee1eec3111071ea6fb8d5605715ae29d9ed78c0f9a5db2be9001c38e91da68 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 31 Jul 2020 08:13:11 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT status 200 vary Origin, Accept-Encoding cf-request-id 044587b8700000176a8d84e200000001 last-modified Thu, 04 Jun 2020 23:13:28 GMT server cloudflare x-frame-options DENY etag W/"cd03b0702af0808a130a752d302aa9ff" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript access-control-allow-origin https://botclient.gq x-xss-protection 1; mode=block cache-control public, max-age=2592000 access-control-allow-credentials true cf-ray 5bb5dbd3e9b1176a-FRA access-control-allow-headers cookie,authorization,content-type,x-failed-requests,x-fingerprint,x-super-properties,if-none-match,x-context-properties access-control-allow-method POST, GET, OPTIONS, DELETE, PUT
GET H2	200	07ca8d15cc9ad4ffc0f6.js Show response q2497732f.tk/assets/	268 KB 78 KB	98ms 37ms	Fetch application/javascript	2606:4700:3031::ac43:8297 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://q2497732f.tk/assets/07ca8d15cc9ad4ffc0f6.js Requested by Host: botclient.gq URL: https://botclient.gq/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::ac43:8297 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 00d2008ce6e24ccb5446bfc817baf5f8ccd50c553617ac514e054c1eed210ad5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 31 Jul 2020 08:13:11 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT status 200 vary Origin, Accept-Encoding cf-request-id 044587b8700000176a8d84f200000001 last-modified Thu, 04 Jun 2020 22:49:35 GMT server cloudflare x-frame-options DENY etag W/"3c3348d7e00a2650144c72246b944d40" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript access-control-allow-origin https://botclient.gq x-xss-protection 1; mode=block cache-control public, max-age=2592000 access-control-allow-credentials true cf-ray 5bb5dbd3e9b3176a-FRA access-control-allow-headers cookie,authorization,content-type,x-failed-requests,x-fingerprint,x-super-properties,if-none-match,x-context-properties access-control-allow-method POST, GET, OPTIONS, DELETE, PUT
GET H2	200	c05bdc0c5c3c90e28c77.js Show response q2497732f.tk/assets/	156 KB 48 KB	97ms 36ms	Fetch application/javascript	2606:4700:3031::ac43:8297 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://q2497732f.tk/assets/c05bdc0c5c3c90e28c77.js Requested by Host: botclient.gq URL: https://botclient.gq/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::ac43:8297 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3a54dfbd23e8e5430f9f5dd464a9eff92cb1bfc18bce64380da20765dc6927eb Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 31 Jul 2020 08:13:11 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT status 200 vary Origin, Accept-Encoding cf-request-id 044587b8700000176a8d850200000001 last-modified Thu, 04 Jun 2020 23:13:28 GMT server cloudflare x-frame-options DENY etag W/"89aeee783a0f8e4cb7c2606913a54205" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript access-control-allow-origin https://botclient.gq x-xss-protection 1; mode=block cache-control public, max-age=2592000 access-control-allow-credentials true cf-ray 5bb5dbd3e9b4176a-FRA access-control-allow-headers cookie,authorization,content-type,x-failed-requests,x-fingerprint,x-super-properties,if-none-match,x-context-properties access-control-allow-method POST, GET, OPTIONS, DELETE, PUT
GET H2	200	7288c77130c62ff8aa82.js q2497732f.tk/assets/	12 MB 3 MB	119ms 59ms	Fetch application/javascript	2606:4700:3031::ac43:8297 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://q2497732f.tk/assets/7288c77130c62ff8aa82.js Requested by Host: botclient.gq URL: https://botclient.gq/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::ac43:8297 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 31 Jul 2020 08:13:11 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT status 200 vary Origin, Accept-Encoding cf-request-id 044587b8700000176a8d851200000001 last-modified Thu, 04 Jun 2020 23:13:29 GMT server cloudflare x-frame-options DENY etag W/"d6818644e03cff2f7f3fcd88d8560fe7" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript access-control-allow-origin https://botclient.gq x-xss-protection 1; mode=block cache-control public, max-age=2592000 access-control-allow-credentials true cf-ray 5bb5dbd3e9b5176a-FRA access-control-allow-headers cookie,authorization,content-type,x-failed-requests,x-fingerprint,x-super-properties,if-none-match,x-context-properties access-control-allow-method POST, GET, OPTIONS, DELETE, PUT
GET H2	200	d957722319139c2c6f69.worker.js Show response q2497732f.tk/assets/	8 KB 3 KB	22ms 22ms	Fetch application/javascript	2606:4700:3031::ac43:8297 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://q2497732f.tk/assets/d957722319139c2c6f69.worker.js Requested by Host: botclient.gq URL: https://botclient.gq/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::ac43:8297 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9ef5e9455163a0f87d6abfad825678756b6425129888db186d310df76d08ebe5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 31 Jul 2020 08:13:12 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT status 200 vary Origin, Accept-Encoding cf-request-id 044587bb1f0000176a8d876200000001 last-modified Tue, 05 May 2020 21:00:20 GMT server cloudflare x-frame-options DENY etag W/"777996320962cf134f8cf2c538a06724" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript access-control-allow-origin https://botclient.gq x-xss-protection 1; mode=block cache-control public, max-age=2592000 access-control-allow-credentials true cf-ray 5bb5dbd839c2176a-FRA access-control-allow-headers cookie,authorization,content-type,x-failed-requests,x-fingerprint,x-super-properties,if-none-match,x-context-properties access-control-allow-method POST, GET, OPTIONS, DELETE, PUT
GET		experiments discord.com/api/v6/	0 0
GET H2	200	0.2d737cc92c807c265e1f.css q2497732f.tk/assets/	1 MB 185 KB	60ms 39ms	Stylesheet text/css	2606:4700:3031::ac43:8297 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://q2497732f.tk/assets/0.2d737cc92c807c265e1f.css Requested by Host: botclient.gq URL: https://botclient.gq/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::ac43:8297 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1784e9baa97ab89c7eff52ebc50f68dc0a71d1564cdbb6121c9f3bd5eeeb9a67 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 31 Jul 2020 08:13:13 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT status 200 vary Origin, Accept-Encoding cf-request-id 044587bfb100001f2d5689e200000001 last-modified Thu, 04 Jun 2020 22:49:35 GMT server cloudflare x-frame-options DENY etag W/"ec58df4511f59177a23ebb23992ffdd1" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/css access-control-allow-origin https://discordclient.com x-xss-protection 1; mode=block cache-control public, max-age=2592000 access-control-allow-credentials true cf-ray 5bb5dbdf8df81f2d-FRA access-control-allow-headers cookie,authorization,content-type,x-failed-requests,x-fingerprint,x-super-properties,if-none-match,x-context-properties access-control-allow-method POST, GET, OPTIONS, DELETE, PUT
GET BLOB	200 OK	a4181388-9ab7-4744-bf89-828211da1526 https://botclient.gq/	8 KB 0		Other application/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://botclient.gq/a4181388-9ab7-4744-bf89-828211da1526 Requested by Host: botclient.gq URL: https://botclient.gq/ Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash 9ef5e9455163a0f87d6abfad825678756b6425129888db186d310df76d08ebe5 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Length 7837 Content-Type application/javascript
GET H2	200	507500d442ffd04ff63c.js Show response q2497732f.tk/assets/	11 KB 4 KB	45ms 44ms	Fetch application/javascript	2606:4700:3031::ac43:8297 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://q2497732f.tk/assets/507500d442ffd04ff63c.js Requested by Host: botclient.gq URL: https://botclient.gq/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::ac43:8297 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ccf15a74e05b3a1a0300e242eef8ab16ed2af0d09d929a0956d4a0d42a88ca33 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 31 Jul 2020 08:13:13 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT status 200 vary Origin, Accept-Encoding cf-request-id 044587c0150000176a8d8eb200000001 last-modified Thu, 04 Jun 2020 20:47:17 GMT server cloudflare x-frame-options DENY etag W/"c1d456669cdb43ff0b5c56ec8d8926f4" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript access-control-allow-origin https://botclient.gq x-xss-protection 1; mode=block cache-control public, max-age=2592000 access-control-allow-credentials true cf-ray 5bb5dbe029ea176a-FRA access-control-allow-headers cookie,authorization,content-type,x-failed-requests,x-fingerprint,x-super-properties,if-none-match,x-context-properties access-control-allow-method POST, GET, OPTIONS, DELETE, PUT
GET BLOB	200 OK	d50b06c5-6d1a-4f08-97ed-7e7563a84248 Show response https://botclient.gq/	11 KB 0		Script application/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://botclient.gq/d50b06c5-6d1a-4f08-97ed-7e7563a84248 Requested by Host: botclient.gq URL: https://botclient.gq/ Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash ccf15a74e05b3a1a0300e242eef8ab16ed2af0d09d929a0956d4a0d42a88ca33 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Length 11532 Content-Type application/javascript
GET		experiments discord.com/api/v6/	0 0
GET		experiments discord.com/api/v6/	0 0
GET		experiments discord.com/api/v6/	0 0
GET H2	200	eaa33f3c20d20e5d912d.js Show response q2497732f.tk/assets/	1 MB 260 KB	40ms 40ms	Fetch application/javascript	2606:4700:3031::ac43:8297 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://q2497732f.tk/assets/eaa33f3c20d20e5d912d.js Requested by Host: botclient.gq URL: https://botclient.gq/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::ac43:8297 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 46361595879e57ec7e80b3e0469aef94cb7cb03dc5f816c1f78dc1030b6c5ce9 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 31 Jul 2020 08:13:18 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT status 200 vary Origin, Accept-Encoding cf-request-id 044587d1490000176a8d9c9200000001 last-modified Thu, 04 Jun 2020 23:13:28 GMT server cloudflare x-frame-options DENY etag W/"684fa32141977755895273881efb567f" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript access-control-allow-origin https://botclient.gq x-xss-protection 1; mode=block cache-control public, max-age=2592000 access-control-allow-credentials true cf-ray 5bb5dbfbad7b176a-FRA access-control-allow-headers cookie,authorization,content-type,x-failed-requests,x-fingerprint,x-super-properties,if-none-match,x-context-properties access-control-allow-method POST, GET, OPTIONS, DELETE, PUT
GET BLOB	200 OK	7419e96a-2d0a-4d70-b5f9-8006535e65c2 Show response https://botclient.gq/	1 MB 0		Script application/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://botclient.gq/7419e96a-2d0a-4d70-b5f9-8006535e65c2 Requested by Host: botclient.gq URL: https://botclient.gq/ Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash ab99ac1bd681a5b3b56e1c34baa290ceaabece99a9476cac441f56a48736ad37 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Length 1441793 Content-Type application/javascript
GET H2	200	4f004ac9be168ac6ee18fc442a52ab53.svg q2497732f.tk/assets/	2 KB 1 KB	42ms 42ms	Image image/svg+xml	2606:4700:3031::ac43:8297 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://q2497732f.tk/assets/4f004ac9be168ac6ee18fc442a52ab53.svg Requested by Host: botclient.gq URL: https://botclient.gq/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::ac43:8297 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dbf36b2b2e321feebbfd92930ca921ccd2f6831c56e012bc049b41d260b0903f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers Referer https://q2497732f.tk/assets/0.2d737cc92c807c265e1f.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 31 Jul 2020 08:13:18 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT status 200 vary Origin, Accept-Encoding cf-request-id 044587d24a00001f2d5699b200000001 last-modified Wed, 26 Jun 2019 04:16:06 GMT server cloudflare x-frame-options DENY etag W/"4f004ac9be168ac6ee18fc442a52ab53" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type image/svg+xml access-control-allow-origin https://discordclient.com x-xss-protection 1; mode=block cache-control public, max-age=2592000 access-control-allow-credentials true cf-ray 5bb5dbfd488d1f2d-FRA access-control-allow-headers cookie,authorization,content-type,x-failed-requests,x-fingerprint,x-super-properties,if-none-match,x-context-properties access-control-allow-method POST, GET, OPTIONS, DELETE, PUT
GET H2	200	e8acd7d9bf6207f99350ca9f9e23b168.woff q2497732f.tk/assets/	76 KB 33 KB	26ms 25ms	Font application/font-woff	2606:4700:3031::ac43:8297 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://q2497732f.tk/assets/e8acd7d9bf6207f99350ca9f9e23b168.woff Requested by Host: botclient.gq URL: https://botclient.gq/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::ac43:8297 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0f823bc4b56f481fbceab4158d855e5d11628198a9e404b827b755fe45d4d1c4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://q2497732f.tk/assets/0.2d737cc92c807c265e1f.css Origin https://botclient.gq Response headers date Fri, 31 Jul 2020 08:13:18 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT status 200 vary Origin, Accept-Encoding cf-request-id 044587d24e0000176a8d9dd200000001 last-modified Fri, 13 Sep 2019 18:44:29 GMT server cloudflare x-frame-options DENY etag W/"e8acd7d9bf6207f99350ca9f9e23b168" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/font-woff access-control-allow-origin https://botclient.gq x-xss-protection 1; mode=block cache-control public, max-age=2592000 access-control-allow-credentials true cf-ray 5bb5dbfd48a3176a-FRA access-control-allow-headers cookie,authorization,content-type,x-failed-requests,x-fingerprint,x-super-properties,if-none-match,x-context-properties access-control-allow-method POST, GET, OPTIONS, DELETE, PUT
GET H2	200	be0060dafb7a0e31d2a1ca17c0708636.woff q2497732f.tk/assets/	81 KB 34 KB	30ms 30ms	Font application/font-woff	2606:4700:3031::ac43:8297 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://q2497732f.tk/assets/be0060dafb7a0e31d2a1ca17c0708636.woff Requested by Host: botclient.gq URL: https://botclient.gq/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::ac43:8297 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9231ab6a48732396feaa62c4ed6d5419cee16ef5657e97a779041cb0a612d0ff Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://q2497732f.tk/assets/0.2d737cc92c807c265e1f.css Origin https://botclient.gq Response headers date Fri, 31 Jul 2020 08:13:18 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT status 200 vary Origin, Accept-Encoding cf-request-id 044587d2560000176a8d9de200000001 last-modified Wed, 26 Jun 2019 04:16:05 GMT server cloudflare x-frame-options DENY etag W/"be0060dafb7a0e31d2a1ca17c0708636" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/font-woff access-control-allow-origin https://botclient.gq x-xss-protection 1; mode=block cache-control public, max-age=2592000 access-control-allow-credentials true cf-ray 5bb5dbfd58c0176a-FRA access-control-allow-headers cookie,authorization,content-type,x-failed-requests,x-fingerprint,x-super-properties,if-none-match,x-context-properties access-control-allow-method POST, GET, OPTIONS, DELETE, PUT
GET H2	200	3bdef1251a424500c1b3a78dea9b7e57.woff q2497732f.tk/assets/	75 KB 31 KB	32ms 32ms	Font application/font-woff	2606:4700:3031::ac43:8297 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://q2497732f.tk/assets/3bdef1251a424500c1b3a78dea9b7e57.woff Requested by Host: botclient.gq URL: https://botclient.gq/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::ac43:8297 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ba33ed18fe9c110039549c2b17fee622de2b27d90cfd4a375bd0184174705fae Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://q2497732f.tk/assets/0.2d737cc92c807c265e1f.css Origin https://botclient.gq Response headers date Fri, 31 Jul 2020 08:13:18 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT status 200 vary Origin, Accept-Encoding cf-request-id 044587d2560000176a8d9df200000001 last-modified Wed, 26 Jun 2019 04:16:17 GMT server cloudflare x-frame-options DENY etag W/"3bdef1251a424500c1b3a78dea9b7e57" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/font-woff access-control-allow-origin https://botclient.gq x-xss-protection 1; mode=block cache-control public, max-age=2592000 access-control-allow-credentials true cf-ray 5bb5dbfd58c7176a-FRA access-control-allow-headers cookie,authorization,content-type,x-failed-requests,x-fingerprint,x-super-properties,if-none-match,x-context-properties access-control-allow-method POST, GET, OPTIONS, DELETE, PUT
GET H2	200	fd91131ea693096d6be5e8aa99d18f9e.jpg q2497732f.tk/assets/	363 KB 364 KB	31ms 30ms	Image image/jpeg	2606:4700:3031::ac43:8297 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://q2497732f.tk/assets/fd91131ea693096d6be5e8aa99d18f9e.jpg Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::ac43:8297 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a54311ff26fac801ea1a33e0acca8276f13626ba9a9ae631bdc673f22f9f2729 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 31 Jul 2020 08:13:18 GMT x-content-type-options nosniff cf-cache-status HIT status 200 vary Origin, Accept-Encoding content-length 372085 cf-request-id 044587d27e00001f2d5699d200000001 last-modified Wed, 26 Jun 2019 04:16:27 GMT server cloudflare x-frame-options DENY etag "fd91131ea693096d6be5e8aa99d18f9e" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type image/jpeg access-control-allow-origin https://discordclient.com x-xss-protection 1; mode=block cache-control public, max-age=2592000 access-control-allow-credentials true accept-ranges bytes cf-ray 5bb5dbfd99241f2d-FRA access-control-allow-headers cookie,authorization,content-type,x-failed-requests,x-fingerprint,x-super-properties,if-none-match,x-context-properties access-control-allow-method POST, GET, OPTIONS, DELETE, PUT cf-bgj h2pri
GET H2	200	c8f0b54f79a9fd1ef60ad74c73a1ee1a.png q2497732f.tk/assets/	47 KB 47 KB	26ms 26ms	Image image/png	2606:4700:3031::ac43:8297 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://q2497732f.tk/assets/c8f0b54f79a9fd1ef60ad74c73a1ee1a.png Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::ac43:8297 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8ae8119962b9358ab934ffb612e634fa23ca462c720c8915a8306c4c984d1cba Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 31 Jul 2020 08:13:18 GMT x-content-type-options nosniff cf-cache-status HIT status 200 vary Origin, Accept-Encoding content-length 48168 cf-request-id 044587d27e00001f2d5699e200000001 last-modified Wed, 26 Jun 2019 04:16:26 GMT server cloudflare x-frame-options DENY etag "c8f0b54f79a9fd1ef60ad74c73a1ee1a" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type image/png access-control-allow-origin https://discordclient.com x-xss-protection 1; mode=block cache-control public, max-age=2592000 access-control-allow-credentials true accept-ranges bytes cf-ray 5bb5dbfd99251f2d-FRA access-control-allow-headers cookie,authorization,content-type,x-failed-requests,x-fingerprint,x-super-properties,if-none-match,x-context-properties access-control-allow-method POST, GET, OPTIONS, DELETE, PUT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

discord.com

URL

https://discord.com/api/v6/experiments

Domain

discord.com

URL

https://discord.com/api/v6/experiments

Domain

discord.com

URL

https://discord.com/api/v6/experiments

Domain

discord.com

URL

https://discord.com/api/v6/experiments

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Discord (Instant Messenger)

23 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| __OVERLAY__ boolean| __BILLING_STANDALONE__ object| GLOBAL_ENV object| assets object| unavailableGuilds function| findModule function| findModules function| findRawModule function| monkeyPatch object| webpackJsonp object| __core-js_shared__ object| core function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill object| __SENTRY__ object| DiscordSentry function| $ function| jQuery function| _ object| platform object| IntlPolyfill

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

17 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://botclient.gq/(Line 77) Message: null
console-api	log	URL: https://botclient.gq/(Line 153) Message: loaded /assets/e1180c171e5a54377584.js
console-api	log	URL: https://botclient.gq/(Line 153) Message: loaded /assets/c05bdc0c5c3c90e28c77.js
console-api	log	(Line 16) Message: loaded /assets/07ca8d15cc9ad4ffc0f6.js
console-api	log	(Line 16) Message: loaded /assets/7288c77130c62ff8aa82.js
console-api	log	(Line 16) Message: worker
console-api	log	(Line 16) Message: [object Object]
console-api	log	(Line 16) Message: varname ie
console-api	log	(Line 16) Message: [BUILD INFO] Release Channel: stable, Build Number: 61151, Version Hash: d9b3bbf67efa3616b831ec73a7cb92be04c2675f
console-api	log	(Line 16) Message: patch login screen
console-api	info	(Line 16) Message: %c[LoginQRSocket] font-weight: bold; color: purple; [0ms] connecting to wss://remote-auth-gateway.discord.gg/?v=1
console-api	info	(Line 16) Message: %c[LoginQRSocket] font-weight: bold; color: purple; [129ms] disconnected, error: [object Event]
console-api	info	(Line 16) Message: %c[LoginQRSocket] font-weight: bold; color: purple; [130ms] disconnected, code: 1006
console-api	info	(Line 16) Message: %c[LoginQRSocket] font-weight: bold; color: purple; [4188ms] cleaning up
console-api	info	(Line 16) Message: %c[LoginQRSocket] font-weight: bold; color: purple; [0ms] connecting to wss://remote-auth-gateway.discord.gg/?v=1
console-api	info	(Line 16) Message: %c[LoginQRSocket] font-weight: bold; color: purple; [149ms] disconnected, error: [object Event]
console-api	info	(Line 16) Message: %c[LoginQRSocket] font-weight: bold; color: purple; [150ms] disconnected, code: 1006

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

botclient.gq
code.jquery.com
discord.com
q2497732f.tk
discord.com
162.159.128.233
209.197.3.24
2606:4700:3031::ac43:8297
35.201.120.147
00d2008ce6e24ccb5446bfc817baf5f8ccd50c553617ac514e054c1eed210ad5
0f823bc4b56f481fbceab4158d855e5d11628198a9e404b827b755fe45d4d1c4
1784e9baa97ab89c7eff52ebc50f68dc0a71d1564cdbb6121c9f3bd5eeeb9a67
3a54dfbd23e8e5430f9f5dd464a9eff92cb1bfc18bce64380da20765dc6927eb
46361595879e57ec7e80b3e0469aef94cb7cb03dc5f816c1f78dc1030b6c5ce9
8ae8119962b9358ab934ffb612e634fa23ca462c720c8915a8306c4c984d1cba
9231ab6a48732396feaa62c4ed6d5419cee16ef5657e97a779041cb0a612d0ff
9ef5e9455163a0f87d6abfad825678756b6425129888db186d310df76d08ebe5
9fee1eec3111071ea6fb8d5605715ae29d9ed78c0f9a5db2be9001c38e91da68
a54311ff26fac801ea1a33e0acca8276f13626ba9a9ae631bdc673f22f9f2729
ab99ac1bd681a5b3b56e1c34baa290ceaabece99a9476cac441f56a48736ad37
ba33ed18fe9c110039549c2b17fee622de2b27d90cfd4a375bd0184174705fae
ccf15a74e05b3a1a0300e242eef8ab16ed2af0d09d929a0956d4a0d42a88ca33
dbf36b2b2e321feebbfd92930ca921ccd2f6831c56e012bc049b41d260b0903f
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
f801c4029b906f943612585c3612ee65eb24ca4a7da152588e5702b26b1da44c