cool.sceroeder.cyou Open in urlscan Pro
5.104.107.248 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://balsunut.com/foztaxhsvd
Effective URL:
https://cool.sceroeder.cyou/s/14534492ea333
Submission Tags: falconsandbox
Submission: On January 02 via api (January 2nd 2025, 4:38:27 pm UTC) from US — Scanned from ES

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 15 HTTP transactions. The main IP is 5.104.107.248, located in Düsseldorf, Germany and belongs to MYLOC-AS WIIT AG, DE. The main domain is cool.sceroeder.cyou.
TLS certificate: Issued by R11 on December 30th 2024. Valid for: 3 months.

This is the only time cool.sceroeder.cyou was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Porn Scam (Online)

Domain & IP information

	IP Address	AS Autonomous System
2	94.159.97.133 94.159.97.133	215730 (H2NEXUS-A...) (H2NEXUS-AS H2NEXUS LTD)
11	5.104.107.248 5.104.107.248	24961 (MYLOC-AS ...) (MYLOC-AS WIIT AG)
1	2a00:1450:400... 2a00:1450:4001:801::200a	15169 (GOOGLE) (GOOGLE)
1	172.217.18.3 172.217.18.3	15169 (GOOGLE) (GOOGLE)
15	4

2 94.159.97.133 (Russian Federation)

ASN215730 (H2NEXUS-AS H2NEXUS LTD, GB)
PTR: 80338.h2.nexus

balsunut.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 5.104.107.248 (Düsseldorf, Germany)

ASN24961 (MYLOC-AS WIIT AG, DE)
PTR: srv11409.dus4.dedicated.server-hosting.expert

cool.sceroeder.cyou	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:801::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.18.3 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s22-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	sceroeder.cyou cool.sceroeder.cyou	210 KB
2	balsunut.com balsunut.com	5 KB
1	gstatic.com fonts.gstatic.com	23 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 29	838 B
15	4

	Domain	Requested by
11	cool.sceroeder.cyou	cool.sceroeder.cyou
2	balsunut.com
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	cool.sceroeder.cyou
15	4

This site contains no links.

Subject Issuer	Validity	Valid
balsunut.com R10	`2024-12-31` - `2025-03-31`	3 months	crt.sh
cool.sceroeder.cyou R11	`2024-12-30` - `2025-03-30`	3 months	crt.sh
upload.video.google.com WR2	`2024-12-02` - `2025-02-24`	3 months	crt.sh
*.gstatic.com WR2	`2024-12-02` - `2025-02-24`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://cool.sceroeder.cyou/s/14534492ea333
Frame ID: 63D47BAC27D0AE17F7B081926799777F
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

El sitio de citas más popular de este mes

Page URL History Show full URLs

https://balsunut.com/foztaxhsvd Page URL
https://cool.sceroeder.cyou/s/14534492ea333 Page URL

Detected technologies

animate.css (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link [^>]+(?:/([\d.]+)/)?animate\.(?:min\.)?css

Page Statistics

15
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

239 kB
Transfer

498 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://balsunut.com/foztaxhsvd Page URL
https://cool.sceroeder.cyou/s/14534492ea333 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK foztaxhsvd Show response
balsunut.com/ 11 KB
5 KB 613ms
313ms Document
text/html 94.159.97.133
H2NEXUS-AS H2NEXU...

General

Check archive.org

Show headers Download Go to

Full URL: https://balsunut.com/foztaxhsvd
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.159.97.133 , Russian Federation, ASN215730 (H2NEXUS-AS H2NEXUS LTD, GB),
Reverse DNS: 80338.h2.nexus
Software: openresty / PHP/7.2.30
Resource Hash: 00fbd2d2587cef0efe3d7e7dc8c733c572bb26b5c578555463d78489abb4c2d7

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Thu, 02 Jan 2025 16:38:21 GMT
Server: openresty
Transfer-Encoding: chunked
X-Powered-By: PHP/7.2.30

GET
H/1.1 404
Not Found favicon.ico
balsunut.com/ 552 B
363 B 115ms
115ms Other
text/html 94.159.97.133
H2NEXUS-AS H2NEXU...

General

Check archive.org

Show headers Download Go to

Full URL: https://balsunut.com/favicon.ico
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.159.97.133 , Russian Federation, ASN215730 (H2NEXUS-AS H2NEXUS LTD, GB),
Reverse DNS: 80338.h2.nexus
Software: openresty /
Resource Hash: a980b60a8922f510d2da527e74ec9443a57dcc65444dbd6a3ae87dceb28090eb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://balsunut.com/foztaxhsvd

Response headers

Transfer-Encoding: chunked
Content-Encoding: gzip
Date: Thu, 02 Jan 2025 16:38:21 GMT
Content-Type: text/html
Server: openresty
Connection: keep-alive

GET
H2 200 Primary Request 14534492ea333 Show response
cool.sceroeder.cyou/s/ 41 KB
17 KB 750ms
219ms Document
text/html 5.104.107.248
MYLOC-AS WIIT AG

General

Check archive.org

Show headers Download Go to

Full URL: https://cool.sceroeder.cyou/s/14534492ea333
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 5.104.107.248 Düsseldorf, Germany, ASN24961 (MYLOC-AS WIIT AG, DE),
Reverse DNS: srv11409.dus4.dedicated.server-hosting.expert
Software: openresty /
Resource Hash: 52ba1475c778371fad34c93a531a21d7867ffc081d6da768e1b3f2b5782c15be

Request headers

Referer: https://balsunut.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

cache-control: must-revalidate, no-cache, no-store, private
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Thu, 02 Jan 2025 16:38:24 GMT
expires: 0
pragma: no-cache
server: openresty
vary: Accept-Encoding

GET
H2 200 animate.min.css
cool.sceroeder.cyou/bundle/93/assets/css/ 52 KB
5 KB 72ms
71ms Stylesheet
text/css 5.104.107.248
MYLOC-AS WIIT AG

General

Check archive.org

Show headers Download Go to

Full URL: https://cool.sceroeder.cyou/bundle/93/assets/css/animate.min.css
Requested by: Host: cool.sceroeder.cyou
URL: https://cool.sceroeder.cyou/s/14534492ea333
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 5.104.107.248 Düsseldorf, Germany, ASN24961 (MYLOC-AS WIIT AG, DE),
Reverse DNS: srv11409.dus4.dedicated.server-hosting.expert
Software: openresty /
Resource Hash: 8fe3fa119255adb5e0c12479331f9e092e85bcff56ab6ecc0510bfa2056b898d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://cool.sceroeder.cyou/s/14534492ea333

Response headers

cache-control: max-age=2592000
content-encoding: gzip
etag: W/"5c0f7fc6-ce35"
expires: Sat, 01 Feb 2025 16:38:24 GMT
date: Thu, 02 Jan 2025 16:38:24 GMT
content-type: text/css
vary: Accept-Encoding
server: openresty
last-modified: Tue, 11 Dec 2018 09:13:42 GMT

GET
H2 200 style.css
cool.sceroeder.cyou/bundle/93/assets/css/ 18 KB
4 KB 73ms
72ms Stylesheet
text/css 5.104.107.248
MYLOC-AS WIIT AG

General

Check archive.org

Show headers Download Go to

Full URL: https://cool.sceroeder.cyou/bundle/93/assets/css/style.css
Requested by: Host: cool.sceroeder.cyou
URL: https://cool.sceroeder.cyou/s/14534492ea333
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 5.104.107.248 Düsseldorf, Germany, ASN24961 (MYLOC-AS WIIT AG, DE),
Reverse DNS: srv11409.dus4.dedicated.server-hosting.expert
Software: openresty /
Resource Hash: 8a3266d75cf5c8adb363028de6d6948bd2ad188e998ac5b369e51c264a9dd9e4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://cool.sceroeder.cyou/s/14534492ea333

Response headers

cache-control: max-age=2592000
content-encoding: gzip
etag: W/"5c0f7fc6-4915"
expires: Sat, 01 Feb 2025 16:38:24 GMT
date: Thu, 02 Jan 2025 16:38:24 GMT
content-type: text/css
vary: Accept-Encoding
server: openresty
last-modified: Tue, 11 Dec 2018 09:13:42 GMT

GET
H2 200 main.css
cool.sceroeder.cyou/bundle/93/assets/css/ 434 B
466 B 73ms
72ms Stylesheet
text/css 5.104.107.248
MYLOC-AS WIIT AG

General

Check archive.org

Show headers Download Go to

Full URL: https://cool.sceroeder.cyou/bundle/93/assets/css/main.css
Requested by: Host: cool.sceroeder.cyou
URL: https://cool.sceroeder.cyou/s/14534492ea333
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 5.104.107.248 Düsseldorf, Germany, ASN24961 (MYLOC-AS WIIT AG, DE),
Reverse DNS: srv11409.dus4.dedicated.server-hosting.expert
Software: openresty /
Resource Hash: f82a5734fd80acfdab995c1347c99fddee31f432f527f8c5118152f968aa56b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://cool.sceroeder.cyou/s/14534492ea333

Response headers

cache-control: max-age=2592000
content-encoding: gzip
etag: W/"5c0f7fc6-1b2"
expires: Sat, 01 Feb 2025 16:38:24 GMT
date: Thu, 02 Jan 2025 16:38:24 GMT
content-type: text/css
vary: Accept-Encoding
server: openresty
last-modified: Tue, 11 Dec 2018 09:13:42 GMT

GET
H2 200 script.js Show response
cool.sceroeder.cyou/bundle/93/assets/js/ 252 KB
84 KB 75ms
75ms Script
application/javascript 5.104.107.248
MYLOC-AS WIIT AG

General

Check archive.org

Show headers Download Go to

Full URL: https://cool.sceroeder.cyou/bundle/93/assets/js/script.js
Requested by: Host: cool.sceroeder.cyou
URL: https://cool.sceroeder.cyou/s/14534492ea333
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 5.104.107.248 Düsseldorf, Germany, ASN24961 (MYLOC-AS WIIT AG, DE),
Reverse DNS: srv11409.dus4.dedicated.server-hosting.expert
Software: openresty /
Resource Hash: 984b3c43a8ae19d927a26a6c8e1d951cf155fb5cd2c69c4855d7e4d99828a685

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://cool.sceroeder.cyou/s/14534492ea333

Response headers

cache-control: max-age=2592000
content-encoding: gzip
etag: W/"5c0f7fc6-3f07c"
expires: Sat, 01 Feb 2025 16:38:24 GMT
date: Thu, 02 Jan 2025 16:38:24 GMT
content-type: application/javascript
vary: Accept-Encoding
server: openresty
last-modified: Tue, 11 Dec 2018 09:13:42 GMT

GET
H2 200 main.js Show response
cool.sceroeder.cyou/bundle/93/assets/js/ 98 B
309 B 137ms
137ms Script
application/javascript 5.104.107.248
MYLOC-AS WIIT AG

General

Check archive.org

Show headers Download Go to

Full URL: https://cool.sceroeder.cyou/bundle/93/assets/js/main.js
Requested by: Host: cool.sceroeder.cyou
URL: https://cool.sceroeder.cyou/s/14534492ea333
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 5.104.107.248 Düsseldorf, Germany, ASN24961 (MYLOC-AS WIIT AG, DE),
Reverse DNS: srv11409.dus4.dedicated.server-hosting.expert
Software: openresty /
Resource Hash: 06d8974fb718e17d1bb74c5361f64f76c3c1dd3022e9082feb57f0df4294910e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://cool.sceroeder.cyou/s/14534492ea333

Response headers

cache-control: max-age=2592000
content-encoding: gzip
etag: W/"5c0f7fc6-62"
expires: Sat, 01 Feb 2025 16:38:24 GMT
date: Thu, 02 Jan 2025 16:38:24 GMT
content-type: application/javascript
vary: Accept-Encoding
server: openresty
last-modified: Tue, 11 Dec 2018 09:13:42 GMT

GET
H2 200 css
fonts.googleapis.com/ 774 B
838 B 191ms
68ms Stylesheet
text/css 2a00:1450:4001:801::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato&subset=latin-ext

Requested by

Host: cool.sceroeder.cyou
URL: https://cool.sceroeder.cyou/bundle/93/assets/css/style.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

52d62465d244bef9c22960bed269d931eb2b705dff7f09a0bcf5ddba62554f45

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://cool.sceroeder.cyou/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Thu, 02 Jan 2025 16:38:24 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 02 Jan 2025 16:38:24 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Thu, 02 Jan 2025 16:38:24 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 no.png
cool.sceroeder.cyou/bundle/93/assets/img/ 322 B
492 B 62ms
61ms Image
image/png 5.104.107.248
MYLOC-AS WIIT AG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cool.sceroeder.cyou/bundle/93/assets/img/no.png
Requested by: Host: cool.sceroeder.cyou
URL: https://cool.sceroeder.cyou/bundle/93/assets/css/style.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 5.104.107.248 Düsseldorf, Germany, ASN24961 (MYLOC-AS WIIT AG, DE),
Reverse DNS: srv11409.dus4.dedicated.server-hosting.expert
Software: openresty /
Resource Hash: 855f62c34d296773b690bcd61d702db042b6085294928d1f7064c022b47d2695

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://cool.sceroeder.cyou/bundle/93/assets/css/style.css

Response headers

cache-control: max-age=2592000
etag: "5c0f7fc6-142"
expires: Sat, 01 Feb 2025 16:38:24 GMT
content-length: 322
date: Thu, 02 Jan 2025 16:38:24 GMT
content-type: image/png
last-modified: Tue, 11 Dec 2018 09:13:42 GMT
server: openresty

GET
H2 200 yes.png
cool.sceroeder.cyou/bundle/93/assets/img/ 594 B
764 B 63ms
62ms Image
image/png 5.104.107.248
MYLOC-AS WIIT AG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cool.sceroeder.cyou/bundle/93/assets/img/yes.png
Requested by: Host: cool.sceroeder.cyou
URL: https://cool.sceroeder.cyou/bundle/93/assets/css/style.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 5.104.107.248 Düsseldorf, Germany, ASN24961 (MYLOC-AS WIIT AG, DE),
Reverse DNS: srv11409.dus4.dedicated.server-hosting.expert
Software: openresty /
Resource Hash: 3e80058e1e64f3e5085e47096d373ae6b74987d494aec75b3f67872706569ef4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://cool.sceroeder.cyou/bundle/93/assets/css/style.css

Response headers

cache-control: max-age=2592000
etag: "5c0f7fc6-252"
expires: Sat, 01 Feb 2025 16:38:24 GMT
content-length: 594
date: Thu, 02 Jan 2025 16:38:24 GMT
content-type: image/png
last-modified: Tue, 11 Dec 2018 09:13:42 GMT
server: openresty

GET
H2 200 1.jpg
cool.sceroeder.cyou/bundle/93/assets/img/ 96 KB
96 KB 63ms
63ms Image
image/jpeg 5.104.107.248
MYLOC-AS WIIT AG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cool.sceroeder.cyou/bundle/93/assets/img/1.jpg
Requested by: Host: cool.sceroeder.cyou
URL: https://cool.sceroeder.cyou/bundle/93/assets/css/style.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 5.104.107.248 Düsseldorf, Germany, ASN24961 (MYLOC-AS WIIT AG, DE),
Reverse DNS: srv11409.dus4.dedicated.server-hosting.expert
Software: openresty /
Resource Hash: 5684f590d545dab40ab38307050e149b143417a0fa0ad216c808c8d3e782bf61

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://cool.sceroeder.cyou/bundle/93/assets/css/style.css

Response headers

cache-control: max-age=2592000
etag: "5c0f7fc6-17f32"
expires: Sat, 01 Feb 2025 16:38:24 GMT
content-length: 98098
date: Thu, 02 Jan 2025 16:38:24 GMT
content-type: image/jpeg
last-modified: Tue, 11 Dec 2018 09:13:42 GMT
server: openresty

GET
H2 200 pattern.png
cool.sceroeder.cyou/bundle/93/assets/img/ 1 KB
1 KB 123ms
123ms Image
image/png 5.104.107.248
MYLOC-AS WIIT AG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cool.sceroeder.cyou/bundle/93/assets/img/pattern.png
Requested by: Host: cool.sceroeder.cyou
URL: https://cool.sceroeder.cyou/bundle/93/assets/css/style.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 5.104.107.248 Düsseldorf, Germany, ASN24961 (MYLOC-AS WIIT AG, DE),
Reverse DNS: srv11409.dus4.dedicated.server-hosting.expert
Software: openresty /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://cool.sceroeder.cyou/bundle/93/assets/css/style.css

Response headers

cache-control: max-age=2592000
etag: "5c0f7fc6-e98"
expires: Sat, 01 Feb 2025 16:38:24 GMT
content-length: 3736
date: Thu, 02 Jan 2025 16:38:24 GMT
content-type: image/png
last-modified: Tue, 11 Dec 2018 09:13:42 GMT
server: openresty

GET
H3 200 S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v24/ 23 KB
23 KB 128ms
59ms Font
font/woff2 172.217.18.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato&subset=latin-ext

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.3 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f3.1e100.net

Software

sffe /

Resource Hash

918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://cool.sceroeder.cyou
Referer: https://fonts.googleapis.com/

Response headers

age: 199489
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 31 Dec 2025 09:13:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 31 Dec 2024 09:13:35 GMT
last-modified: Tue, 02 May 2023 15:17:22 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 23580
x-xss-protection: 0
server: sffe

GET
H2 404 favicon.ico
cool.sceroeder.cyou/ 993 B
779 B 65ms
64ms Other
text/html 5.104.107.248
MYLOC-AS WIIT AG

General

Check archive.org

Show headers Download Go to

Full URL: https://cool.sceroeder.cyou/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 5.104.107.248 Düsseldorf, Germany, ASN24961 (MYLOC-AS WIIT AG, DE),
Reverse DNS: srv11409.dus4.dedicated.server-hosting.expert
Software: openresty /
Resource Hash: 25d3409669519deee0adb32c70906510d0d85f8174025bb6b6a0ab1954bb0621

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://cool.sceroeder.cyou/s/14534492ea333

Response headers

cache-control: no-cache, private
content-encoding: gzip
date: Thu, 02 Jan 2025 16:38:24 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding, Accept
server: openresty

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Porn Scam (Online)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.sceroeder.cyou/	1970-01-21 02:12:02	Name: s Value: BFnyGhyVcXQRDdBxXF5woOJYFjfbrT1wJAxkqMDnwr%2BE5mg5H6akxK58i5JQ27axvec%2FQQ6POU7hXVjc6R0OKiB%2BLvaRHqJb%2BRS476qb1SjDbLabMDOYz8ofW3D1GVzdOMkG4kumUTaI6%2Fs03kr08eZ%2B81TTvdwFLg%2BS6RN9r4mIhE3uA1WquhbC5pw6N88E70PbbTKrMrUvva8e0SwP3GzcQWU%2F%2BT%2FW0kUOXy3FUbAHH8EORBb%2Bs1W1UBTqNkXN7P%2BsVMCObvfrCj3Gf8ffDg9URCvswde%2B2MjTFbyuE9BwgL%2B7eWmk4RfjYfsU6mef4RwcubETak3oWET8macqymwY87oE%2BEyGGa2GVUoh0gvcHcJA1jya4hw16FayjL0vbx8gUvbhFSl321mApkIfzcjymY6p0c8gDwpHVY0pvjQ1DbCda4SFvDw1IJPqBK5r05h%2FWHK9kdaUghb0w9x%2B2EhWVTh6LO5rMgWQOTJLKi6%2BIZbxqenDm6NmzA0si74mlXRJXWror4wbckZKxuLIWvmcK%2FmUAYypvHdorgtww28uuBorKv79PFKqPM26OXLkL1hmi1Fb63nluy03FUYIIS11HXpGVt0ozfSdXl83Ne%2FeaLbSTrJOXaSlXVsSdjzKq%2F1JOWp2pAuW9K5GgBgexMj2aYFmx3gk7o2Q%2B4RNRQjFS0Yh07ORQSuDISsPur416Nu8eVYjCCWgIohOaEs9ci82RLcK7lTR0ebK3gLkjbsqcnULsoaXm7QAttJNyTemv1tkTZmxF39YfTSmdXjPwu%2Fk6QEL1CyIQ4s9NHhn1f6O6A3Huix9jQNAGYdh9Ns0%2BiLohi4UNJpD0Hf3Ymu28%2BzREdMNtBRXz4%2F0msm2OMDy1kC2sWayn8RHYlGkZYRj1criPcg5xjL2o%2F4u4I76IAGEFMpHN8l%2By1zEKQajkJMTHE4oJhxlptTy4%2FPoT2P8NFcoiwHG6KETYU7MZu2SQZ9stHhbmueuhx%2FpMvBnGtJtbGpajZ801FEIfcXvGY1teCRxPIDBgFsv9qJQCmNquwRp0a0Qxf9frWAYFy%2BX65wiLyKBP%2BYRM3w41tE0N46Pv2BKWpszHB0c7D%2BwqAso%2FpkJDjRo8VNsTBfAzO9U%2FjxfF5tNNfZ0fXb9ucUG6%2FkpdVxwy8flrFG%2BxjIpfmFczOnHhPdTJEWkUY3gBTcjRfBKW%2FkdQWMvV%2FfyO64nK2nndhzBKf0wioMzQHakpaULqkTniPpmQbK5YH9uFrugkvs52wl4qrgJqtjExh9nnOIVoYF4q1XwKxErV%2BDO5SGnMZmj8pkgw0nwC2YwHc2H7ZzimToF7TMAR36FQOIw2yfIhl6%2BC36h%2Bq3WSHj0zvMEjdNf8vwwDFz1UMAa5szc%2Bh9XQ%2FFcA5MmXZ9JBskMn%2BgBRqH%2BoSegydM5QsHehuT8p6U06D2Jqmo9ilLoBhYgdu%2B1BmvJNi%2BcLA%2B2DXyuFupZIsPmd3HixXLnpi4V4CyGr%2BOBzhuoeIstD7qfSNNDf4%2FPt7Rt4R14icISF2TIC7m%2FH6hAqzNHhNsA8VolCOkcCN6RLSu0RG9x3m8pZE7AJDmQZ4HcnMQ2VjuW6lcDAxiTmWVl758NFcLbYB2LkQWLD8Zd8hbi39ASY%2Fxoh8vxHwegUMmGUfn6BHju0r%2BJF5fQBaaMRYBuu7yrGE4RhBpZT9kboGEQ4BCQZVZLug2%2FCGvFILO7wk%2FGm2PcwAi5VhRXtbLiETkMrfebwRattC1Hyq5pf0LrTN3z3V4RJ9Gr5Et6%2BGBvQR%2BSklxlRLO1uVd4o0YOx7PmbrRHxN4HzfkJLR7%2Fn6pFaDkJJyEuSKRZlAV0qf0WRribZsd7%2BaKZcuGbcaE7l8ZHySFbKwE%2FqBQ6pa0Wpvf5Wm0%3D

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://balsunut.com/favicon.ico Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://cool.sceroeder.cyou/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

balsunut.com
cool.sceroeder.cyou
fonts.googleapis.com
fonts.gstatic.com
172.217.18.3
2a00:1450:4001:801::200a
5.104.107.248
94.159.97.133
00fbd2d2587cef0efe3d7e7dc8c733c572bb26b5c578555463d78489abb4c2d7
06d8974fb718e17d1bb74c5361f64f76c3c1dd3022e9082feb57f0df4294910e
25d3409669519deee0adb32c70906510d0d85f8174025bb6b6a0ab1954bb0621
3e80058e1e64f3e5085e47096d373ae6b74987d494aec75b3f67872706569ef4
52ba1475c778371fad34c93a531a21d7867ffc081d6da768e1b3f2b5782c15be
52d62465d244bef9c22960bed269d931eb2b705dff7f09a0bcf5ddba62554f45
5684f590d545dab40ab38307050e149b143417a0fa0ad216c808c8d3e782bf61
855f62c34d296773b690bcd61d702db042b6085294928d1f7064c022b47d2695
8a3266d75cf5c8adb363028de6d6948bd2ad188e998ac5b369e51c264a9dd9e4
8fe3fa119255adb5e0c12479331f9e092e85bcff56ab6ecc0510bfa2056b898d
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
984b3c43a8ae19d927a26a6c8e1d951cf155fb5cd2c69c4855d7e4d99828a685
a980b60a8922f510d2da527e74ec9443a57dcc65444dbd6a3ae87dceb28090eb
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f82a5734fd80acfdab995c1347c99fddee31f432f527f8c5118152f968aa56b9

cool.sceroeder.cyou Open in urlscan Pro 5.104.107.248 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

15 Requests

100 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

4 IPs

3 Countries

239 kBTransfer

498 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

13 JavaScript Global Variables

1 Cookies

2 Console Messages

Indicators

cool.sceroeder.cyou Open in urlscan Pro
5.104.107.248 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

239 kB
Transfer

498 kB
Size

1
Cookies

15 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!