u-rl.li Open in urlscan Pro
164.68.121.126 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://boxmodel.pw/
Effective URL:
https://u-rl.li/qRR
Submission: On June 21 via manual (June 21st 2022, 4:25:54 pm UTC) from US — Scanned from DE

Summary HTTP 13 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 13 HTTP transactions. The main IP is 164.68.121.126, located in Nuremberg, Germany and belongs to CONTABO, DE. The main domain is u-rl.li.
TLS certificate: Issued by R3 on June 5th 2022. Valid for: 3 months.

This is the only time u-rl.li was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Cloudflare (Online)

Domain & IP information

	IP Address	AS Autonomous System
2 5	2606:4700:303... 2606:4700:3032::ac43:9871	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	164.68.121.126 164.68.121.126	51167 (CONTABO) (CONTABO)
1	2a00:1450:400... 2a00:1450:4001:812::200a	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:82f::2003	15169 (GOOGLE) (GOOGLE)
13	4

5 2606:4700:3032::ac43:9871 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

boxmodel.pw	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 164.68.121.126 (Nuremberg, Germany)

ASN51167 (CONTABO, DE)
PTR: vmi518798.contaboserver.net

u-rl.li	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	u-rl.li u-rl.li	154 KB
5	boxmodel.pw 2 redirects boxmodel.pw	8 KB
3	gstatic.com fonts.gstatic.com	51 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 67	1 KB
13	4

	Domain	Requested by
6	u-rl.li	u-rl.li
5	boxmodel.pw	2 redirects boxmodel.pw
3	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	u-rl.li
13	4

This site contains links to these domains. Also see Links.

Domain
boxmodel.pw

Subject Issuer	Validity	Valid
*.boxmodel.pw E1	`2022-06-02` - `2022-08-31`	3 months	crt.sh
webdisk.u-rl.li R3	`2022-06-05` - `2022-09-03`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://u-rl.li/qRR
Frame ID: C89F9D94CB4A280594DA1C6280BD4B13
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Error - URL.LI Best Free URL Shortener

Page URL History Show full URLs

https://boxmodel.pw/ Page URL
https://boxmodel.pw/cdn-cgi/phish-bypass?atok=0Lp.v5kuKj2Fp6QL4Q0X.SNWo6fqYQDm03ip0QtD.g4-165582... HTTP 301
https://boxmodel.pw/ HTTP 301
https://u-rl.li/qRR Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

13
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

214 kB
Transfer

887 kB
Size

2
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://boxmodel.pw/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://boxmodel.pw/ Page URL
https://boxmodel.pw/cdn-cgi/phish-bypass?atok=0Lp.v5kuKj2Fp6QL4Q0X.SNWo6fqYQDm03ip0QtD.g4-1655828745-0-%2F HTTP 301
https://boxmodel.pw/ HTTP 301
https://u-rl.li/qRR Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 / Show response
boxmodel.pw/ 4 KB
2 KB 148ms
47ms Document
text/html 2606:4700:3032::ac43:9871
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://boxmodel.pw/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:9871 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

16348c1fff44e9a39d26d5cb75477ceea2d0e9c0a0c613b34eb7ac8b57f79245

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-ray: 71ee1a1b6bcb915e-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 21 Jun 2022 16:25:45 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FvffVkiBJPB0ZCkTvUW2k0W3U%2Flzolu%2FVeGJ4PuCneIfV9%2FIbcg6vWU3M033KvaAAT%2B2Z3tdxETU23hTfuLfVcpethLIcqU7fX3o4Z4XjTKyNqi0S4mvX8SvjCVicwXrtybIni2Uuyp4tw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-frame-options: SAMEORIGIN

GET
H2 200 cf.errors.css
boxmodel.pw/cdn-cgi/styles/ 23 KB
4 KB 41ms
40ms Stylesheet
text/css 2606:4700:3032::ac43:9871
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://boxmodel.pw/cdn-cgi/styles/cf.errors.css

Requested by

Host: boxmodel.pw
URL: https://boxmodel.pw/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:9871 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

efefef4dea8e9c02dc9079fcfe64205b48b0f96ba73dfba169fb7919b8768f1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://boxmodel.pw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Tue, 21 Jun 2022 16:25:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 14 Jun 2022 16:43:10 GMT
server: cloudflare
etag: W/"62a8ba9e-5c8b"
x-frame-options: DENY
content-type: text/css
cache-control: max-age=7200, public
cf-ray: 71ee1a1bbc51915e-FRA
vary: Accept-Encoding
expires: Tue, 21 Jun 2022 18:25:45 GMT

GET
H2 200 icon-exclamation.png
boxmodel.pw/cdn-cgi/images/ 452 B
539 B 39ms
39ms Image
image/png 2606:4700:3032::ac43:9871
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://boxmodel.pw/cdn-cgi/images/icon-exclamation.png?1376755637

Requested by

Host: boxmodel.pw
URL: https://boxmodel.pw/cdn-cgi/styles/cf.errors.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:9871 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://boxmodel.pw/cdn-cgi/styles/cf.errors.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Tue, 21 Jun 2022 16:25:45 GMT
x-content-type-options: nosniff
last-modified: Tue, 14 Jun 2022 16:43:10 GMT
server: cloudflare
etag: "62a8ba9e-1c4"
x-frame-options: DENY
content-type: image/png
cache-control: max-age=7200, public
accept-ranges: bytes
cf-ray: 71ee1a1c0cbc915e-FRA
vary: Accept-Encoding
content-length: 452
expires: Tue, 21 Jun 2022 18:25:45 GMT

GET
H/1.1

404
Not Found

Primary Request qRR Show response
u-rl.li/
Redirect Chain

https://boxmodel.pw/cdn-cgi/phish-bypass?atok=0Lp.v5kuKj2Fp6QL4Q0X.SNWo6fqYQDm03ip0QtD.g4-1655828745-0-%2F
https://boxmodel.pw/
https://u-rl.li/qRR

4 KB
2 KB

270ms
132ms

Document
text/html

164.68.121.126
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL: https://u-rl.li/qRR
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 164.68.121.126 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS: vmi518798.contaboserver.net
Software: Apache /
Resource Hash: 697d231b0106d61dda3d0b70f5a05e6e62e021699537dac2cc8e041443f7bc30

Request headers

Referer: https://boxmodel.pw/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 1214
Content-Type: text/html; charset=UTF-8
Date: Tue, 21 Jun 2022 16:25:49 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive: timeout=5, max=100
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=3600
cf-ray: 71ee1a350bac691f-FRA
date: Tue, 21 Jun 2022 16:25:49 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires: Tue, 21 Jun 2022 17:25:49 GMT
location: https://u-rl.li/qRR
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wQmEV0mvBe%2Fhnj45pq3gjXWNRvXc1hhcw9wLx8SjtBqUpWLs38iiDApMLER%2FKozellHjWIce7rHDmCvPLOzDbqaHrVsbTCwFLbPtTef0YJfKsX3Wki1vMru4LW7UA6GmhNhGDDrcRQ9G5w%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H/1.1 200
OK style.css
u-rl.li/static/frontend/css/ 611 KB
79 KB 65ms
64ms Stylesheet
text/css 164.68.121.126
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL: https://u-rl.li/static/frontend/css/style.css
Requested by: Host: u-rl.li
URL: https://u-rl.li/qRR
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 164.68.121.126 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS: vmi518798.contaboserver.net
Software: Apache /
Resource Hash: da25e1368c19e154a0fa54b2ab3275c94056039453e76cea56c234b68a342129

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://u-rl.li/qRR
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date: Tue, 21 Jun 2022 16:25:49 GMT
Content-Encoding: gzip
Last-Modified: Fri, 03 Jun 2022 15:27:08 GMT
Server: Apache
Vary: Accept-Encoding
Content-Type: text/css
Transfer-Encoding: chunked
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99

GET
H/1.1 200
OK 404.svg
u-rl.li/static/images/ 21 KB
21 KB 163ms
48ms Image
image/svg+xml 164.68.121.126
CONTABO

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://u-rl.li/static/images/404.svg
Requested by: Host: u-rl.li
URL: https://u-rl.li/qRR
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 164.68.121.126 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS: vmi518798.contaboserver.net
Software: Apache /
Resource Hash: c422320961beda694d3872f3b8f0a80914ce21907094bc0e3290dbd86ea837b5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://u-rl.li/qRR
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date: Tue, 21 Jun 2022 16:25:50 GMT
Last-Modified: Fri, 03 Jun 2022 15:27:08 GMT
Server: Apache
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 21104

GET
H/1.1 200
OK jquery.min.js Show response
u-rl.li/static/frontend/libs/jquery/dist/ 87 KB
30 KB 127ms
52ms Script
application/javascript 164.68.121.126
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL: https://u-rl.li/static/frontend/libs/jquery/dist/jquery.min.js
Requested by: Host: u-rl.li
URL: https://u-rl.li/qRR
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 164.68.121.126 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS: vmi518798.contaboserver.net
Software: Apache /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://u-rl.li/qRR
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date: Tue, 21 Jun 2022 16:25:50 GMT
Content-Encoding: gzip
Last-Modified: Fri, 03 Jun 2022 15:27:08 GMT
Server: Apache
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 30910

GET
H/1.1 200
OK svg-injector.min.js Show response
u-rl.li/static/frontend/libs/svg-injector/dist/ 4 KB
2 KB 134ms
46ms Script
application/javascript 164.68.121.126
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL: https://u-rl.li/static/frontend/libs/svg-injector/dist/svg-injector.min.js
Requested by: Host: u-rl.li
URL: https://u-rl.li/qRR
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 164.68.121.126 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS: vmi518798.contaboserver.net
Software: Apache /
Resource Hash: 0a306526fc6a2c25361cccc5ba74de9592c51c225daa00e81e2fea18959d4499

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://u-rl.li/qRR
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date: Tue, 21 Jun 2022 16:25:50 GMT
Content-Encoding: gzip
Last-Modified: Fri, 03 Jun 2022 15:27:08 GMT
Server: Apache
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 2168

GET
H/1.1 200
OK feather.min.js Show response
u-rl.li/static/frontend/libs/feather-icons/dist/ 74 KB
21 KB 150ms
55ms Script
application/javascript 164.68.121.126
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL: https://u-rl.li/static/frontend/libs/feather-icons/dist/feather.min.js
Requested by: Host: u-rl.li
URL: https://u-rl.li/qRR
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 164.68.121.126 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS: vmi518798.contaboserver.net
Software: Apache /
Resource Hash: 5dfcdd882f92d647a26beb3d974ef2ef27b96bcef8b01abaef32b8bbb2d38ef9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://u-rl.li/qRR
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date: Tue, 21 Jun 2022 16:25:50 GMT
Content-Encoding: gzip
Last-Modified: Fri, 03 Jun 2022 15:27:08 GMT
Server: Apache
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 20692

GET
H2 200 css
fonts.googleapis.com/ 9 KB
1 KB 131ms
49ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Nunito+Sans:400,400i,600,700,800&display=swap

Requested by

Host: u-rl.li
URL: https://u-rl.li/static/frontend/css/style.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0893f3413251d1c152cc83ead398f13c2afefd44af721faf2ed4bafc6b273db6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://u-rl.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 21 Jun 2022 16:25:50 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 21 Jun 2022 16:25:50 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 21 Jun 2022 16:25:50 GMT

GET
H2 200 pe03MImSLYBIv1o4X1M8cc9iB85tU1E.woff2
fonts.gstatic.com/s/nunitosans/v12/ 17 KB
17 KB 132ms
50ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/nunitosans/v12/pe03MImSLYBIv1o4X1M8cc9iB85tU1E.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Nunito+Sans:400,400i,600,700,800&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c84423c305779f2aab07847a2e3870ac1ea4072e470d5eb149c01e0e0497eae3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://u-rl.li
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 08:47:34 GMT
x-content-type-options: nosniff
age: 545896
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17156
x-xss-protection: 0
last-modified: Mon, 09 May 2022 18:33:24 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 15 Jun 2023 08:47:34 GMT

GET
H2 200 pe0qMImSLYBIv1o4X1M8cce9I9s.woff2
fonts.gstatic.com/s/nunitosans/v12/ 17 KB
17 KB 164ms
82ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/nunitosans/v12/pe0qMImSLYBIv1o4X1M8cce9I9s.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Nunito+Sans:400,400i,600,700,800&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

97d5a594e7f76c7e50045b67667fd6b74b268515efe6425097be1b2647079787

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://u-rl.li
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 08:45:06 GMT
x-content-type-options: nosniff
age: 546044
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16980
x-xss-protection: 0
last-modified: Mon, 09 May 2022 18:33:54 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 15 Jun 2023 08:45:06 GMT

GET
H2 200 pe0oMImSLYBIv1o4X1M8cce4E9lKdg.woff2
fonts.gstatic.com/s/nunitosans/v12/ 17 KB
18 KB 110ms
38ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/nunitosans/v12/pe0oMImSLYBIv1o4X1M8cce4E9lKdg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Nunito+Sans:400,400i,600,700,800&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6637ea3139ffb01e240829717a4f8c195d7be6b81780ed643000b49833d8d6d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://u-rl.li
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Mon, 20 Jun 2022 20:20:52 GMT
x-content-type-options: nosniff
age: 72298
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17684
x-xss-protection: 0
last-modified: Mon, 09 May 2022 18:32:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 20 Jun 2023 20:20:52 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Cloudflare (Online)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.boxmodel.pw/	1970-01-20 03:58:35	Name: __cf_mw_byp Value: 0Lp.v5kuKj2Fp6QL4Q0X.SNWo6fqYQDm03ip0QtD.g4-1655828745-0-/
			u-rl.li/	1969-12-31 23:59:59	Name: PHPSESSID Value: 2cc39a1b87580a3765812128842c01ba

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://u-rl.li/qRR Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

boxmodel.pw
fonts.googleapis.com
fonts.gstatic.com
u-rl.li
164.68.121.126
2606:4700:3032::ac43:9871
2a00:1450:4001:812::200a
2a00:1450:4001:82f::2003
0893f3413251d1c152cc83ead398f13c2afefd44af721faf2ed4bafc6b273db6
0a306526fc6a2c25361cccc5ba74de9592c51c225daa00e81e2fea18959d4499
16348c1fff44e9a39d26d5cb75477ceea2d0e9c0a0c613b34eb7ac8b57f79245
5dfcdd882f92d647a26beb3d974ef2ef27b96bcef8b01abaef32b8bbb2d38ef9
6637ea3139ffb01e240829717a4f8c195d7be6b81780ed643000b49833d8d6d1
697d231b0106d61dda3d0b70f5a05e6e62e021699537dac2cc8e041443f7bc30
97d5a594e7f76c7e50045b67667fd6b74b268515efe6425097be1b2647079787
c422320961beda694d3872f3b8f0a80914ce21907094bc0e3290dbd86ea837b5
c84423c305779f2aab07847a2e3870ac1ea4072e470d5eb149c01e0e0497eae3
da25e1368c19e154a0fa54b2ab3275c94056039453e76cea56c234b68a342129
efefef4dea8e9c02dc9079fcfe64205b48b0f96ba73dfba169fb7919b8768f1f
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

u-rl.li Open in urlscan Pro 164.68.121.126 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

75 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

214 kBTransfer

887 kBSize

2 Cookies

1 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

2 Cookies

1 Console Messages

Security Headers

Indicators

u-rl.li Open in urlscan Pro
164.68.121.126 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

214 kB
Transfer

887 kB
Size

2
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!