urlscan.io logo urlscan.io
SecurityTrails logo

brazilianseduction.com Open in urlscan Pro
163.53.248.25  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://email.mail1.onesignal.os.tc/c/eJwUz7EOpCAQANCvkW4MDMMAhcU1-xsXYMZowq5GMZf9-8v2r3nlPP_usoRVWsqVARsjUPQNssseGsdMKSSVwEYWppBlNb...
Effective URL: https://brazilianseduction.com/wp-admin/css/colors/blue/optussss.html
Submission: On May 03 via manual from AU — Scanned from AU
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 3 countries across 6 domains to perform 10 HTTP transactions. The main IP is 163.53.248.25, located in Australia and belongs to HOSTOPIA-AU Hostopia Australia Web Pty Ltd, AU. The main domain is brazilianseduction.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on February 26th 2023. Valid for: 3 months.
This is the only time brazilianseduction.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Optus (Telecommunication)

Domain & IP information

IP Address AS Autonomous System
1 1 34.110.180.34 396982 (GOOGLE-CL...)
1 79.96.39.60 12824 (HOMEPL-AS)
1 163.53.248.25 55803 (HOSTOPIA-...)
2 6 172.67.187.45 13335 (CLOUDFLAR...)
2 104.17.24.14 ()
10 5
1    34.110.180.34 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 34.180.110.34.bc.googleusercontent.com
email.mail1.onesignal.os.tc
1    79.96.39.60 (Poland)

ASN12824 (HOMEPL-AS, PL)
PTR: cloudserver060766.home.pl
rsmeble.com.pl
1    163.53.248.25 (Australia)

ASN55803 (HOSTOPIA-AU Hostopia Australia Web Pty Ltd, AU)
PTR: vmh18884.hosting24.com.au
brazilianseduction.com
6    172.67.187.45 (United States)

ASN13335 (CLOUDFLARENET, US)
rootxone.org
2    104.17.24.14 (None, )

ASN- ()
cdnjs.cloudflare.com
Apex Domain
Subdomains		 Transfer
6 rootxone.org
rootxone.org
16 KB
2 cloudflare.com
cdnjs.cloudflare.com
28 KB
1 brazilianseduction.com
brazilianseduction.com
3 MB
1 rsmeble.com.pl
rsmeble.com.pl
317 B
1 os.tc
email.mail1.onesignal.os.tc — Cisco Umbrella Rank: 980589
158 B
0 googleapis.com Failed
fonts.googleapis.com Failed
10 6
Domain Requested by
6 rootxone.org 2 redirects brazilianseduction.com
rootxone.org
2 cdnjs.cloudflare.com rootxone.org
1 brazilianseduction.com
1 rsmeble.com.pl
1 email.mail1.onesignal.os.tc 1 redirects
0 fonts.googleapis.com Failed rootxone.org
10 6

This site contains links to these domains. Also see Links.

Domain
www.optus.com.au
Subject Issuer Validity Valid
brazilianseduction.com
cPanel, Inc. Certification Authority		 2023-02-26 -
2023-05-27		 3 months crt.sh
*.rootxone.org
GTS CA 1P5		 2023-03-06 -
2023-06-04		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-08-03 -
2023-08-02		 a year crt.sh

This page contains 2 frames:

Primary Page: https://brazilianseduction.com/wp-admin/css/colors/blue/optussss.html
Frame ID: FED2A9F7A76F32FE68A5DD106794F9D9
Requests: 15 HTTP requests in this frame

Frame: https://rootxone.org/dff72/1/90179/
Frame ID: 260EEF3AB973481E9595B64813227533
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Optus - Webmail

Page URL History Show full URLs

  1. https://email.mail1.onesignal.os.tc/c/eJwUz7EOpCAQANCvkW4MDMMAhcU1-xsXYMZowq5GMZf9-8v2r3nlPP_usoRVWsqVARsjUPQNss... HTTP 302
    http://rsmeble.com.pl/aust.html Page URL
  2. https://brazilianseduction.com/wp-admin/css/colors/blue/optussss.html Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/ns\.html[^>]+></iframe>
  • <!-- (?:End )?Google Tag Manager -->

Page Statistics

10
Requests

70 %
HTTPS

0 %
IPv6

6
Domains

6
Subdomains

5
IPs

3
Countries

2922 kB
Transfer

3828 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://email.mail1.onesignal.os.tc/c/eJwUz7EOpCAQANCvkW4MDMMAhcU1-xsXYMZowq5GMZf9-8v2r3nlPP_usoRVWsqVARsjUPQNssseGsdMKSSVwEYWppBlNbo4Tt4hY0xmW6pLasWR40zCOWIh7xWjY8_MzZt9cT60ENcAiLYAycpQYqwg0aGNWbGpzF3HuHQi249W-nbcw_RlG-Oc_J8JXxO-rvuttevcjvd89glf5bnHvI13N59j7OveytiPz2-UAtqMwlCECpA6gpJSBfHoYovMkaw5e_nq9eOsztqUK2gTD9QoQxGpIC1TaJm9l2qupcz_tn2M70T2GeWeVZ65PP8DAAD__yc4X0A HTTP 302
    http://rsmeble.com.pl/aust.html Page URL
  2. https://brazilianseduction.com/wp-admin/css/colors/blue/optussss.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://email.mail1.onesignal.os.tc/c/eJwUz7EOpCAQANCvkW4MDMMAhcU1-xsXYMZowq5GMZf9-8v2r3nlPP_usoRVWsqVARsjUPQNssseGsdMKSSVwEYWppBlNbo4Tt4hY0xmW6pLasWR40zCOWIh7xWjY8_MzZt9cT60ENcAiLYAycpQYqwg0aGNWbGpzF3HuHQi249W-nbcw_RlG-Oc_J8JXxO-rvuttevcjvd89glf5bnHvI13N59j7OveytiPz2-UAtqMwlCECpA6gpJSBfHoYovMkaw5e_nq9eOsztqUK2gTD9QoQxGpIC1TaJm9l2qupcz_tn2M70T2GeWeVZ65PP8DAAD__yc4X0A HTTP 302
  • http://rsmeble.com.pl/aust.html
Request Chain 13
  • https://rootxone.org/dff72/index.php HTTP 302
  • https://rootxone.org/dff72/1/index.php HTTP 302
  • https://rootxone.org/dff72/1/90179/

10 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
aust.html
rsmeble.com.pl/
Redirect Chain
  • https://email.mail1.onesignal.os.tc/c/eJwUz7EOpCAQANCvkW4MDMMAhcU1-xsXYMZowq5GMZf9-8v2r3nlPP_usoRVWsqVARsjUPQNssseGsdMKSSVwEYWppBlNbo4Tt4hY0xmW6pLasWR40zCOWIh7xWjY8_MzZt9cT60ENcAiLYAycpQYqwg0aGNWbG...
  • http://rsmeble.com.pl/aust.html
116 B
317 B 		Document
General
Check archive.org
Download Go to
Full URL
http://rsmeble.com.pl/aust.html
Protocol
HTTP/1.1
Server
79.96.39.60 , Poland, ASN12824 (HOMEPL-AS, PL),
Reverse DNS
cloudserver060766.home.pl
Software
IdeaWebServer/5.1.0 /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
en-AU,en;q=0.9

Response headers

Connection
keep-alive
Content-Length
116
Content-Type
text/html
Date
Wed, 03 May 2023 22:26:45 GMT
Last-Modified
Wed, 03 May 2023 13:56:07 GMT
Server
IdeaWebServer/5.1.0

Redirect headers

access-control-allow-credentials
true
access-control-allow-origin
*
cache-control
no-store
content-length
412
content-type
text/html
date
Wed, 03 May 2023 22:26:44 GMT
location
http://rsmeble.com.pl/aust.html
x-robots-tag
noindex
x-xss-protection
1; mode=block
Primary Request optussss.html
brazilianseduction.com/wp-admin/css/colors/blue/ 		3 MB
3 MB 		Document
General
Check archive.org
Download Go to
Full URL
https://brazilianseduction.com/wp-admin/css/colors/blue/optussss.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
163.53.248.25 , Australia, ASN55803 (HOSTOPIA-AU Hostopia Australia Web Pty Ltd, AU),
Reverse DNS
vmh18884.hosting24.com.au
Software
Apache /
Resource Hash
9d3c9886090370bbfdf2700e9714ac8ee2a851ed36ad54a3384d526ccfd5880c

Request headers

Referer
http://rsmeble.com.pl/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
en-AU,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
Keep-Alive
Content-Length
2947887
Content-Type
text/html
Date
Wed, 03 May 2023 22:26:45 GMT
Keep-Alive
timeout=5, max=100
Last-Modified
Wed, 03 May 2023 12:47:07 GMT
Server
Apache
truncated
/ 		108 KB
0 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
Origin
https://brazilianseduction.com
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type
text/plain
truncated
/ 		23 KB
0 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
Origin
https://brazilianseduction.com
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type
text/plain
truncated
/ 		24 KB
0 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
Origin
https://brazilianseduction.com
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type
text/plain
truncated
/ 		23 KB
0 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
Origin
https://brazilianseduction.com
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type
text/plain
truncated
/ 		65 KB
0 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
Origin
https://brazilianseduction.com
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type
text/plain
truncated
/ 		66 KB
0 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
Origin
https://brazilianseduction.com
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type
text/plain
truncated
/ 		62 KB
0 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
Origin
https://brazilianseduction.com
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type
text/plain
truncated
/ 		129 KB
0 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
Origin
https://brazilianseduction.com
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type
text/plain
truncated
/ 		129 KB
0 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
Origin
https://brazilianseduction.com
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type
text/plain
truncated
/ 		65 KB
0 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
Origin
https://brazilianseduction.com
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type
text/plain
truncated
/ 		66 KB
0 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
Origin
https://brazilianseduction.com
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type
text/plain
truncated
/ 		57 KB
0 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
Origin
https://brazilianseduction.com
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type
text/plain
/
rootxone.org/dff72/1/90179/ Frame 260E
Redirect Chain
  • https://rootxone.org/dff72/index.php
  • https://rootxone.org/dff72/1/index.php
  • https://rootxone.org/dff72/1/90179/
17 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://rootxone.org/dff72/1/90179/
Requested by
Host: brazilianseduction.com
URL: https://brazilianseduction.com/wp-admin/css/colors/blue/optussss.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.187.45 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/8.1.14RC1
Resource Hash
1c295e8d1ac13abdd0bf143552df2e0ceaa52ee374ce746a9ea971c36c14e082

Request headers

Referer
https://brazilianseduction.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
en-AU,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7c1bed7cdd1daad8-SYD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Wed, 03 May 2023 22:26:49 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GfZ7HWEFoW%2FbiOjBZVM%2BYn3oeolBHTkmnWx%2B7AxlWmnc3KtTzAy1eBlHg6iHQyTDzOZ3Tq9rsMoSKWVMcFogiLD937OJLGyT3tTtddNHvyHDFiVWEPZl6O%2BV5tW3Wh4%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-powered-by
PHP/8.1.14RC1

Redirect headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7c1bed7a3a8ba973-SYD
content-type
text/html; charset=UTF-8
date
Wed, 03 May 2023 22:26:48 GMT
location
https://rootxone.org/dff72/1/90179/
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fG9wdFGb4g7lv6m5DvmJAGLPvtYtnUxVCylJ9wE23KAoYiuUGRqRxELKS%2FmpCbmtXfyl9upYX8uq7hh%2BLhFXd1pPxsYh0UxCaWJPD3NthZYecJ3xh0cFuhT%2FL5ocEXs%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
PHP/8.1.14RC1
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6f7079f7f44f2ef5c07100f61ee2843c1c3720158e62a1948c186f00c882b8aa

Request headers

accept-language
en-AU,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type
image/png
css
fonts.googleapis.com/ Frame 260E 		0
0
font-awesome.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ Frame 260E 		37 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css
Requested by
Host: rootxone.org
URL: https://rootxone.org/dff72/1/90179/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.24.14 -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://rootxone.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Wed, 03 May 2023 22:26:49 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
530287
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
5884
last-modified
Mon, 04 May 2020 16:10:07 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e5f-9226"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vOAk49JRtKL4Z6c9e9uxVD8hG%2FwZ3Z39Gt%2BWCfsKQnCZwUPGGRtGTv%2B3%2Fgfbw13VQq%2BKy%2FNWlXvcoDj0bhlf0zyQpQD%2FGebG4fIo1S5dGbSZVdqz9VXkTMgRmcLl9GIlDjnQUD9Z"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7c1bed826ebda838-SYD
expires
Mon, 22 Apr 2024 22:26:49 GMT
zocial.css
cdnjs.cloudflare.com/ajax/libs/css-social-buttons/1.2.0/css/ Frame 260E 		44 KB
21 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/css-social-buttons/1.2.0/css/zocial.css
Requested by
Host: rootxone.org
URL: https://rootxone.org/dff72/1/90179/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.24.14 -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
bf8d41c2e2250b2f0b431531871178d57cd9af1f42bbe121c90b51fd66a1dff2
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://rootxone.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Wed, 03 May 2023 22:26:49 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
59076
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
21543
last-modified
Mon, 04 May 2020 16:09:17 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e2d-ae99"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HKphtwp3Ig13fMgIUqth9zhxViKDexIHjgUiaG%2BKqqq7wIKVUfL54frFt9sVak7qagYIn%2FbZbt0POH8yea6Uht9m%2FrLzvQRU%2F6Pxzpl1oHsG52h7DZhkStVpAK0%2B0wYTkqh%2Fal3o"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7c1bed826ebfa838-SYD
expires
Mon, 22 Apr 2024 22:26:49 GMT
style.css
rootxone.org/dff72/sourcexone/xonecss/ Frame 260E 		18 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://rootxone.org/dff72/sourcexone/xonecss/style.css
Requested by
Host: rootxone.org
URL: https://rootxone.org/dff72/1/90179/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.187.45 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a34fb4112dac269525802264dfe989c4bfce795635799fcc2f8726c0e2fb496f

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://rootxone.org/dff72/1/90179/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Wed, 03 May 2023 22:26:49 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Wed, 03 May 2023 12:41:01 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
3172
etag
W/"4771-5fac95e4f66f4"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kSMLIOlXVddiuKuQhisQ1%2FOri1CIhx3ZfgmMn%2Be8mwAwlwTxhz%2BHhWVtT3bt3VBGZKvz%2Fpw6YYWrgT5uXhSWw3c1GRfRFDWjCfvmSNl7Fj9VaC582pFAjmnGNvWVKMs%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
7c1bed8128b0aad8-SYD
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
stepbar.css
rootxone.org/dff72/sourcexone/xonecss/ Frame 260E 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://rootxone.org/dff72/sourcexone/xonecss/stepbar.css
Requested by
Host: rootxone.org
URL: https://rootxone.org/dff72/1/90179/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.187.45 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a1a0917eca00cbcf2fd9f9c97031af5035645e18718f8e6ba239bf69314bc081

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://rootxone.org/dff72/1/90179/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Wed, 03 May 2023 22:26:49 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Wed, 03 May 2023 12:41:01 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
3172
etag
W/"db8-5fac95e4f6adc"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=964Ky3V%2Bp3r6aMwmVjasNRKBJMINDUn%2F9g7VeiAbWE%2Badi6w8H4SgIxaaTUK9P8myOsirIaGyONgLbcq0agG1NPbTDy615NrYTGhr4enJYKgaSPhf7UvyxL6m3usnEQ%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
7c1bed8128b2aad8-SYD
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
rocket-loader.min.js
rootxone.org/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ Frame 260E 		12 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rootxone.org/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Requested by
Host: rootxone.org
URL: https://rootxone.org/dff72/1/90179/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.187.45 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://rootxone.org/dff72/1/90179/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Wed, 03 May 2023 22:26:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 25 Apr 2023 11:29:10 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"6447b986-302c"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PrYe6E3V2uNmotOLQOZiaLjlK69wfRpRjHNs3wLrU1GIDWSwjFGBuXd5lFMv3yBXaAaQYaG5QfyuwLqbLJIy5VR4F%2B6AFz3bf8JSnOJWxQyE3b6TC07CT0zmwtWYx6A%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
x-frame-options
DENY
cache-control
max-age=172800, public
cf-ray
7c1bed8128b3aad8-SYD
expires
Fri, 05 May 2023 22:26:49 GMT
css
fonts.googleapis.com/ Frame 260E 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
fonts.googleapis.com
URL
https://fonts.googleapis.com/css?family=Lato:400,100,300
Domain
fonts.googleapis.com
URL
https://fonts.googleapis.com/css?family=Source+Code+Pro:400,500,600,700|Source+Sans+Pro:400,600,700&display=swap

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Optus (Telecommunication)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 boolean| credentialless function| savepage_ShadowLoader

0 Cookies