Submitted URL: https://twrmas.com/new/waqzqmwbekkqbeg
Effective URL: https://antivir.site/click.php?key=xfuj7zk26fwjnd6l0bta&click_id=3085c24900a85af316173ad504511d5b&price=1.250000&sub1...
Submission Tags: @phish_report
Submission: On December 11 via api from FI — Scanned from FI

Summary

This website contacted 6 IPs in 3 countries across 6 domains to perform 7 HTTP transactions. The main IP is 178.132.6.250, located in Naaldwijk, Netherlands and belongs to WORLDSTREAM, NL. The main domain is antivir.site.
TLS certificate: Issued by R3 on September 27th 2023. Valid for: 3 months.
This is the only time antivir.site was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 104.21.37.94 13335 (CLOUDFLAR...)
1 172.217.18.8 15169 (GOOGLE)
1 104.20.80.99 13335 (CLOUDFLAR...)
1 2 192.243.59.12 39572 (ADVANCEDH...)
1 178.132.6.250 49981 (WORLDSTREAM)
7 6
Apex Domain
Subdomains
Transfer
2 pricklywolf.com
pricklywolf.com
4 KB
1 antivir.site
antivir.site
66 KB
1 histats.com
s10.histats.com — Cisco Umbrella Rank: 15174
s4.histats.com Failed
5 KB
1 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 36
1 twrmas.com
twrmas.com
1 KB
0 proftrafficcounter.com Failed
proftrafficcounter.com Failed
7 6
Domain Requested by
2 pricklywolf.com 1 redirects twrmas.com
1 antivir.site
1 s10.histats.com twrmas.com
1 www.googletagmanager.com twrmas.com
1 twrmas.com
0 proftrafficcounter.com Failed pricklywolf.com
0 s4.histats.com Failed s10.histats.com
7 7

This site contains no links.

Subject Issuer Validity Valid
twrmas.com
E1
2023-12-03 -
2024-03-02
3 months crt.sh
*.google-analytics.com
GTS CA 1C3
2023-11-20 -
2024-02-12
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2023-05-13 -
2024-05-11
a year crt.sh
pricklywolf.com
R3
2023-12-06 -
2024-03-05
3 months crt.sh
antivir.site
R3
2023-09-27 -
2023-12-26
3 months crt.sh

This page contains 1 frames:

Primary Page: https://antivir.site/click.php?key=xfuj7zk26fwjnd6l0bta&click_id=3085c24900a85af316173ad504511d5b&price=1.250000&sub1=18974811&sub2=1.250000&sub3=907488&sub4=FI&sub5=87.95.117.138&mcount=0&type=direct
Frame ID: A3DF7AE15082302AF46B6B09E0CB7B4C
Requests: 8 HTTP requests in this frame

Screenshot

Page Title

Windows cleanup is recommended!

Page URL History Show full URLs

  1. https://twrmas.com/new/waqzqmwbekkqbeg Page URL
  2. https://pricklywolf.com/ij6sk7s1?key=55f17a9fee68ea1b6f4ccfa2d96ecf6e Page URL
  3. https://pricklywolf.com/api/users?token=L2lqNnNrN3MxP2tleT01NWYxN2E5ZmVlNjhlYTFiNmY0Y2NmYTJkOTZlY2Y2... HTTP 302
    https://antivir.site/click.php?key=xfuj7zk26fwjnd6l0bta&click_id=3085c24900a85af316173ad504511d5b... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js

Page Statistics

7
Requests

71 %
HTTPS

0 %
IPv6

6
Domains

7
Subdomains

6
IPs

3
Countries

74 kB
Transfer

351 kB
Size

17
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://twrmas.com/new/waqzqmwbekkqbeg Page URL
  2. https://pricklywolf.com/ij6sk7s1?key=55f17a9fee68ea1b6f4ccfa2d96ecf6e Page URL
  3. https://pricklywolf.com/api/users?token=L2lqNnNrN3MxP2tleT01NWYxN2E5ZmVlNjhlYTFiNmY0Y2NmYTJkOTZlY2Y2ZSZwc3Q9MTcwMjI1NDkxOSZyZWZlcj1odHRwcyUzQSUyRiUyRnR3cm1hcy5jb20lMkYmcm10Yz10JnNodT1iNjdiM2RlMWZlNWQxYWE2NjhkODFmZThhNmViMmRlYjIwNGIxYmM4YWJkY2Q2ZTEwYTdiMDAxNDEyOTJhNzliZjcyNDlhMTc0ODY2OTM2NDcxMmRhNzc3MWU4YjI0NzhlYTU4ZDJkY2U5NzA2ZjhlZDUwZjYwNjhlOGVjZmY5MjAyOTk5ZjhmMzY5NGY5MDcyODU3YzY1YTc0NzY2OTYzNmYyN2YwOGQzMTAzMTY5ZDQ4MTZiZGVmYzZlZjczM2U1NTAzYmU%3D&uuid=&pii=&in=false HTTP 302
    https://antivir.site/click.php?key=xfuj7zk26fwjnd6l0bta&click_id=3085c24900a85af316173ad504511d5b&price=1.250000&sub1=18974811&sub2=1.250000&sub3=907488&sub4=FI&sub5=87.95.117.138&mcount=0&type=direct Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
waqzqmwbekkqbeg
twrmas.com/new/
2 KB
1 KB
Document
General
Full URL
https://twrmas.com/new/waqzqmwbekkqbeg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.37.94 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
19255e2633492c0710f75ba4e37a712d07b3c33e4f8235c6eb541eb499553af9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language
fi-FI,fi;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8339a4229f794c88-HEL
content-encoding
br
content-type
text/html; charset=UTF-8
date
Mon, 11 Dec 2023 00:34:18 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5DhbiIOAviOYl400RYMS4LjuAvg9nhf3ERj9kkS3D6GYsFlOHebBd9aZKPskholFdKX%2F0QveJhM0L3bpGrW1D5sYgTLjpVl%2Bc5M4c9B2gcKJkE3KlonrHSezryhJ"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-content-type-options
nosniff
x-server-powered-by
Engintron
x-xss-protection
1; mode=block
js
www.googletagmanager.com/gtag/
187 KB
0
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-51273128-1
Requested by
Host: twrmas.com
URL: https://twrmas.com/new/waqzqmwbekkqbeg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.8 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s22-in-f8.1e100.net
Software
Google Tag Manager /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://twrmas.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date
Mon, 11 Dec 2023 00:34:19 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
69134
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Mon, 11 Dec 2023 00:34:19 GMT
js15_as.js
s10.histats.com/
11 KB
5 KB
Script
General
Full URL
https://s10.histats.com/js15_as.js
Requested by
Host: twrmas.com
URL: https://twrmas.com/new/waqzqmwbekkqbeg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.80.99 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://twrmas.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date
Mon, 11 Dec 2023 00:34:19 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Thu, 16 Apr 2020 10:44:16 GMT
server
cloudflare
age
70235
etag
"-375139978"
vary
Accept-Encoding
content-type
text/javascript
cache-control
max-age=28800
accept-ranges
bytes
cf-ray
8339a4280d01d97f-HEL
content-length
4547
ij6sk7s1
pricklywolf.com/
3 KB
3 KB
Document
General
Full URL
https://pricklywolf.com/ij6sk7s1?key=55f17a9fee68ea1b6f4ccfa2d96ecf6e
Requested by
Host: twrmas.com
URL: https://twrmas.com/new/waqzqmwbekkqbeg
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.243.59.12 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.19.5 /
Resource Hash
9c79887caaef976c7fffd54f6e0c2673250a5667f148b2defcbb24a9f6622adc
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubdomains

Request headers

Referer
https://twrmas.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language
fi-FI,fi;q=0.9

Response headers

Accept-CH
Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Cache-Control
no-cache
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html
Date
Mon, 11 Dec 2023 00:34:19 GMT
Expires
Thu, 01 Jan 1970 00:00:01 GMT
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Server
nginx/1.19.5
Strict-Transport-Security
max-age=0; includeSubdomains
Transfer-Encoding
chunked
X-Request-ID
fcbbd136fff47b2abdb03cf4cc32fbc5
0.php
s4.histats.com/stats/
0
0

stats
proftrafficcounter.com/
0
0

Primary Request click.php
antivir.site/
Redirect Chain
  • https://pricklywolf.com/api/users?token=L2lqNnNrN3MxP2tleT01NWYxN2E5ZmVlNjhlYTFiNmY0Y2NmYTJkOTZlY2Y2ZSZwc3Q9MTcwMjI1NDkxOSZyZWZlcj1odHRwcyUzQSUyRiUyRnR3cm1hcy5jb20lMkYmcm10Yz10JnNodT1iNjdiM2RlMWZlN...
  • https://antivir.site/click.php?key=xfuj7zk26fwjnd6l0bta&click_id=3085c24900a85af316173ad504511d5b&price=1.250000&sub1=18974811&sub2=1.250000&sub3=907488&sub4=FI&sub5=87.95.117.138&mcount=0&type=direct
86 KB
66 KB
Document
General
Full URL
https://antivir.site/click.php?key=xfuj7zk26fwjnd6l0bta&click_id=3085c24900a85af316173ad504511d5b&price=1.250000&sub1=18974811&sub2=1.250000&sub3=907488&sub4=FI&sub5=87.95.117.138&mcount=0&type=direct
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
178.132.6.250 Naaldwijk, Netherlands, ASN49981 (WORLDSTREAM, NL),
Reverse DNS
178-132-6-250.hosted-by-worldstream.net
Software
nginx/1.20.2 /
Resource Hash
308dbca09689d3a5c102d9c208f2302922cbe5bda25ada008baa819450694fad
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://pricklywolf.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language
fi-FI,fi;q=0.9

Response headers

Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Mon, 11 Dec 2023 00:34:21 GMT
Server
nginx/1.20.2
Strict-Transport-Security
max-age=31536000
Transfer-Encoding
chunked

Redirect headers

Accept-CH
Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Cache-Control
no-cache
Connection
keep-alive
Content-Length
0
Content-Type
text/html
Date
Mon, 11 Dec 2023 00:34:20 GMT
Expires
Thu, 01 Jan 1970 00:00:01 GMT
Location
https://antivir.site/click.php?key=xfuj7zk26fwjnd6l0bta&click_id=3085c24900a85af316173ad504511d5b&price=1.250000&sub1=18974811&sub2=1.250000&sub3=907488&sub4=FI&sub5=87.95.117.138&mcount=0&type=direct
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Server
nginx/1.19.5
Strict-Transport-Security
max-age=0; includeSubdomains
X-Request-ID
ee30c28c9ef49fbee719e026c37f919a
truncated
/
62 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c2dbf320547a9b3c289eb44500624bce2eb0e440a85f5777e8e2056ca76c1d26

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type
image/png

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
s4.histats.com
URL
https://s4.histats.com/stats/0.php?4764170&@f16&@g1&@h1&@i1&@j1702254859625&@k0&@l1&@mtwrmas.com%20-%20We%20apologize%20for%20the%20inconvenience%2C%20but%20we%27re%20performing%20some%20maintenance.&@n0&@o1000&@q0&@r0&@s0&@ten-US&@u1600&@b1:23269728&@b3:1702254860&@b4:js15_as.js&@b5:120&@a-_0.2.1&@vhttps%3A%2F%2Ftwrmas.com%2Fnew%2Fwaqzqmwbekkqbeg&@w
Domain
proftrafficcounter.com
URL
https://proftrafficcounter.com/stats

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture

17 Cookies

Domain/Path Name / Value
pricklywolf.com/api Name: iprcb7bbffa4c161665b4fe2154605e51d34
Value: 4743846
pricklywolf.com/api Name: pdhtkv
Value: true
pricklywolf.com/api Name: uncs
Value: 1
pricklywolf.com/api Name: pdhtkv28
Value: true
pricklywolf.com/api Name: uncs28
Value: 1
twrmas.com/ Name: HstCfa4764170
Value: 1702254859625
twrmas.com/ Name: HstCla4764170
Value: 1702254859625
twrmas.com/ Name: HstCmu4764170
Value: 1702254859625
twrmas.com/ Name: HstPn4764170
Value: 1
twrmas.com/ Name: HstPt4764170
Value: 1
twrmas.com/ Name: HstCnv4764170
Value: 1
twrmas.com/ Name: HstCns4764170
Value: 1
pricklywolf.com/ Name: u_pl
Value: 18974811
pricklywolf.com/ Name: ain
Value: eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxODk3NDgxMSwiayI6IjU1ZjE3YTlmZWU2OGVhMWI2ZjRjY2ZhMmQ5NmVjZjZlIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoyMzk3OTA2LCJwaWQiOjE2NDUzNCwiYW4iOnRydWUsImxhbiI6dHJ1ZSwiY2lkIjozOCwiYWlkIjoyOCwicHQiOjQsInBrIjoiaWo2c2s3czEiLCJ0IjoxfSwidSI6eyJ1IjoxLCJhdSI6MSwiZCI6eyJpZCI6MjE0NTA3NzIwLCJpZHMiOiIiLCJpYyI6ZmFsc2UsIm4iOiJEZXNrdG9wLEVtdWxhdG9yIiwidiI6IlVua25vd24iLCJtIjoiVW5rbm93biIsImYiOjEsImZuIjoiRGVza3RvcCIsIm9pZCI6Mzg5MTQsIm9uIjoiV2luZG93cyIsIm92IjoiMTAuMCIsImJpZCI6MTMwMzY2LCJibiI6IkNocm9tZSIsImJ2IjoiMTIwIiwid3YiOmZhbHNlLCJlIjpmYWxzZSwiYWIiOmZhbHNlfSwiYyI6eyJpZCI6NzAsImMiOiJGSSIsIm4iOiJGaW5sYW5kIn0sImEiOmZhbHNlLCJjciI6eyJuIjoiRE5BIE95aiJ9LCJ4ZiI6IiIsIml4ZiI6ZmFsc2UsImlneGYiOmZhbHNlLCJ1cCI6dHJ1ZSwiciI6Imh0dHBzOi8vdHdybWFzLmNvbS8iLCJhciI6W119fQ.Y8s0ZNAphRgcF602Ic1D3YfURwakS7GC07OntkqvStk
pricklywolf.com/ Name: cjs
Value: t
antivir.site/ Name: uclick
Value: h9tlyda56o
antivir.site/ Name: uclickhash
Value: h9tlyda56o-h9tlyda56o-zw0-nttw-7sa0-4pe2-4pb7-f588f5

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block