urlscan.io logo urlscan.io
SecurityTrails logo

brazilianseduction.com Open in urlscan Pro
163.53.248.25  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://email.mail1.onesignal.os.tc/c/eJwc0L3O3CAQheGrMd1YMAMDFC7S7G1E_AwyCru2bDZS7j7y15_iOW86z9-9bq7VEmJmwMII1lOBaCJBYR9tcEGqY1U3ti...
Effective URL: https://brazilianseduction.com/wp-admin/css/colors/blue/optussss.html
Submission: On May 04 via manual from AU — Scanned from AU
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 4 countries across 7 domains to perform 12 HTTP transactions. The main IP is 163.53.248.25, located in Australia and belongs to HOSTOPIA-AU Hostopia Australia Web Pty Ltd, AU. The main domain is brazilianseduction.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on February 26th 2023. Valid for: 3 months.
This is the only time brazilianseduction.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Optus (Telecommunication)

Domain & IP information

IP Address AS Autonomous System
1 1 34.110.180.34 396982 (GOOGLE-CL...)
1 79.96.39.60 12824 (HOMEPL-AS)
1 163.53.248.25 55803 (HOSTOPIA-...)
2 6 172.67.187.45 13335 (CLOUDFLAR...)
2 74.125.24.95 15169 (GOOGLE)
3 104.17.24.14 13335 (CLOUDFLAR...)
12 6
1    34.110.180.34 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 34.180.110.34.bc.googleusercontent.com
email.mail1.onesignal.os.tc
1    79.96.39.60 (Poland)

ASN12824 (HOMEPL-AS, PL)
PTR: cloudserver060766.home.pl
rsmeble.com.pl
1    163.53.248.25 (Australia)

ASN55803 (HOSTOPIA-AU Hostopia Australia Web Pty Ltd, AU)
PTR: vmh18884.hosting24.com.au
brazilianseduction.com
6    172.67.187.45 (United States)

ASN13335 (CLOUDFLARENET, US)
rootxone.org
2    74.125.24.95 (United States)

ASN15169 (GOOGLE, US)
PTR: sf-in-f95.1e100.net
fonts.googleapis.com
3    104.17.24.14 (None, )

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
Apex Domain
Subdomains		 Transfer
6 rootxone.org
rootxone.org
16 KB
3 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 344
104 KB
2 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 119
2 KB
1 brazilianseduction.com
brazilianseduction.com
3 MB
1 rsmeble.com.pl
rsmeble.com.pl
317 B
1 os.tc
email.mail1.onesignal.os.tc — Cisco Umbrella Rank: 980589
301 B
0 rootxone.me Failed
rootxone.me Failed
12 7
Domain Requested by
6 rootxone.org 2 redirects brazilianseduction.com
rootxone.org
3 cdnjs.cloudflare.com rootxone.org
cdnjs.cloudflare.com
2 fonts.googleapis.com rootxone.org
1 brazilianseduction.com
1 rsmeble.com.pl
1 email.mail1.onesignal.os.tc 1 redirects
0 rootxone.me Failed rootxone.org
12 7

This site contains links to these domains. Also see Links.

Domain
www.optus.com.au
Subject Issuer Validity Valid
brazilianseduction.com
cPanel, Inc. Certification Authority		 2023-02-26 -
2023-05-27		 3 months crt.sh
*.rootxone.org
GTS CA 1P5		 2023-03-06 -
2023-06-04		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2023-04-03 -
2023-06-26		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-08-03 -
2023-08-02		 a year crt.sh

This page contains 2 frames:

Primary Page: https://brazilianseduction.com/wp-admin/css/colors/blue/optussss.html
Frame ID: 1A99EBE16FFEDC6806850D2F1DA88196
Requests: 15 HTTP requests in this frame

Frame: https://rootxone.org/dff72/1/f7dff/
Frame ID: 744876D499D3159F6855EF4142F689E8
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Optus - Webmail

Page URL History Show full URLs

  1. http://email.mail1.onesignal.os.tc/c/eJwc0L3O3CAQheGrMd1YMAMDFC7S7G1E_AwyCru2bDZS7j7y15_iOW86z9-9bq7VEmJmwMII1l... HTTP 302
    http://rsmeble.com.pl/aust.html Page URL
  2. https://brazilianseduction.com/wp-admin/css/colors/blue/optussss.html Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • googleapis\.com/.+webfont
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/ns\.html[^>]+></iframe>
  • <!-- (?:End )?Google Tag Manager -->

Page Statistics

12
Requests

83 %
HTTPS

0 %
IPv6

7
Domains

7
Subdomains

6
IPs

4
Countries

3000 kB
Transfer

3923 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://email.mail1.onesignal.os.tc/c/eJwc0L3O3CAQheGrMd1YMAMDFC7S7G1E_AwyCru2bDZS7j7y15_iOW86z9-9bq7VEmJmwMII1lOBaCJBYR9tcEGqY1U3ti7WpmQzHMggktNq34h0iOy9N0Zialg1Z590bpHRimPVN51JdG4FfCYCm0qDGCmDM56cMZpapXXInJcsVo-jpLEf91Rj2-c8F_q14GvB13W_JQ9Zy_Fez7HgK33vue7zPdTnmL31kmY_Ps-j4FBHrAyp2gRWjIUUQoZKaHzxzN5qdY70T65nbjKahMjApZYnQIDcogVHNbMYR0EndW35kjnXIfef_kBzr3_lnj-e9P0fAAD___5SYYk HTTP 302
    http://rsmeble.com.pl/aust.html Page URL
  2. https://brazilianseduction.com/wp-admin/css/colors/blue/optussss.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://email.mail1.onesignal.os.tc/c/eJwc0L3O3CAQheGrMd1YMAMDFC7S7G1E_AwyCru2bDZS7j7y15_iOW86z9-9bq7VEmJmwMII1lOBaCJBYR9tcEGqY1U3ti7WpmQzHMggktNq34h0iOy9N0Zialg1Z590bpHRimPVN51JdG4FfCYCm0qDGCmDM56cMZpapXXInJcsVo-jpLEf91Rj2-c8F_q14GvB13W_JQ9Zy_Fez7HgK33vue7zPdTnmL31kmY_Ps-j4FBHrAyp2gRWjIUUQoZKaHzxzN5qdY70T65nbjKahMjApZYnQIDcogVHNbMYR0EndW35kjnXIfef_kBzr3_lnj-e9P0fAAD___5SYYk HTTP 302
  • http://rsmeble.com.pl/aust.html
Request Chain 8
  • https://rootxone.org/dff72/index.php HTTP 302
  • https://rootxone.org/dff72/1/index.php HTTP 302
  • https://rootxone.org/dff72/1/f7dff/

12 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
aust.html
rsmeble.com.pl/
Redirect Chain
  • http://email.mail1.onesignal.os.tc/c/eJwc0L3O3CAQheGrMd1YMAMDFC7S7G1E_AwyCru2bDZS7j7y15_iOW86z9-9bq7VEmJmwMII1lOBaCJBYR9tcEGqY1U3ti7WpmQzHMggktNq34h0iOy9N0Zialg1Z590bpHRimPVN51JdG4FfCYCm0qDGCmDM56c...
  • http://rsmeble.com.pl/aust.html
116 B
317 B 		Document
General
Check archive.org
Download Go to
Full URL
http://rsmeble.com.pl/aust.html
Protocol
HTTP/1.1
Server
79.96.39.60 , Poland, ASN12824 (HOMEPL-AS, PL),
Reverse DNS
cloudserver060766.home.pl
Software
IdeaWebServer/5.1.0 /
Resource Hash
b5821ee6c77f0825f466a283d8d6682712ff01e261791e3fa40bbe6c0be52b14

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
en-AU,en;q=0.9

Response headers

Connection
keep-alive
Content-Length
116
Content-Type
text/html
Date
Thu, 04 May 2023 00:49:37 GMT
Last-Modified
Wed, 03 May 2023 13:56:07 GMT
Server
IdeaWebServer/5.1.0

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
Cache-Control
no-store
Content-Length
412
Content-Type
text/html
Date
Thu, 04 May 2023 00:49:36 GMT
Location
http://rsmeble.com.pl/aust.html
X-Robots-Tag
noindex
X-Xss-Protection
1; mode=block
Primary Request optussss.html
brazilianseduction.com/wp-admin/css/colors/blue/ 		3 MB
3 MB 		Document
General
Check archive.org
Download Go to
Full URL
https://brazilianseduction.com/wp-admin/css/colors/blue/optussss.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
163.53.248.25 , Australia, ASN55803 (HOSTOPIA-AU Hostopia Australia Web Pty Ltd, AU),
Reverse DNS
vmh18884.hosting24.com.au
Software
Apache /
Resource Hash
9d3c9886090370bbfdf2700e9714ac8ee2a851ed36ad54a3384d526ccfd5880c

Request headers

Referer
http://rsmeble.com.pl/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
en-AU,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
Keep-Alive
Content-Length
2947887
Content-Type
text/html
Date
Thu, 04 May 2023 00:49:37 GMT
Keep-Alive
timeout=5, max=100
Last-Modified
Wed, 03 May 2023 12:47:07 GMT
Server
Apache
truncated
/ 		108 KB
0 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
Origin
https://brazilianseduction.com
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type
text/plain
truncated
/ 		23 KB
0 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
Origin
https://brazilianseduction.com
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type
text/plain
truncated
/ 		24 KB
0 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
Origin
https://brazilianseduction.com
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type
text/plain
truncated
/ 		23 KB
0 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
Origin
https://brazilianseduction.com
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type
text/plain
truncated
/ 		65 KB
0 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
Origin
https://brazilianseduction.com
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type
text/plain
truncated
/ 		66 KB
0 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
Origin
https://brazilianseduction.com
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type
text/plain
truncated
/ 		62 KB
0 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
Origin
https://brazilianseduction.com
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type
text/plain
/
rootxone.org/dff72/1/f7dff/ Frame 7448
Redirect Chain
  • https://rootxone.org/dff72/index.php
  • https://rootxone.org/dff72/1/index.php
  • https://rootxone.org/dff72/1/f7dff/
17 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://rootxone.org/dff72/1/f7dff/
Requested by
Host: brazilianseduction.com
URL: https://brazilianseduction.com/wp-admin/css/colors/blue/optussss.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.187.45 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/8.1.14RC1
Resource Hash
0b1163bb75ff284f5dd61cfc23af87ac0c000f999ea843913f87af375e5ba021

Request headers

Referer
https://brazilianseduction.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
en-AU,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7c1cbec5ab41a894-SYD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Thu, 04 May 2023 00:49:41 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HOmNlISqV%2Fbj9BSu91p%2F4feeUiWXrdOtaueFpdYvaa7gDEjd%2BQWladreByJSuw7uKeTjKzq3O8SyC%2FnlZgL7DudYz%2BrYycKm%2FS1sjJMJvmMqm49ZgsYHi9Ez8dpGqHw%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-powered-by
PHP/8.1.14RC1

Redirect headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7c1cbec33da3aae3-SYD
content-type
text/html; charset=UTF-8
date
Thu, 04 May 2023 00:49:40 GMT
location
https://rootxone.org/dff72/1/f7dff/
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O%2BrRgIPjp3QVXupVnZbF2siFCQCcYOGBQYXP5yRVSYyV0SdmTsMz4l2egMue059bbo8%2BbJqSq6Me9lzlAtyauWPBtrxyx15LKoXOQSG7qjvKKRL17s3FAiNC2irPG3I%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
PHP/8.1.14RC1
truncated
/ 		129 KB
0 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
Origin
https://brazilianseduction.com
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type
text/plain
truncated
/ 		129 KB
0 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
Origin
https://brazilianseduction.com
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type
text/plain
truncated
/ 		65 KB
0 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
Origin
https://brazilianseduction.com
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type
text/plain
truncated
/ 		66 KB
0 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
Origin
https://brazilianseduction.com
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type
text/plain
truncated
/ 		57 KB
0 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
Origin
https://brazilianseduction.com
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type
text/plain
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6f7079f7f44f2ef5c07100f61ee2843c1c3720158e62a1948c186f00c882b8aa

Request headers

accept-language
en-AU,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type
image/png
css
fonts.googleapis.com/ Frame 7448 		2 KB
518 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Lato:400,100,300
Requested by
Host: rootxone.org
URL: https://rootxone.org/dff72/1/f7dff/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
74.125.24.95 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
sf-in-f95.1e100.net
Software
ESF /
Resource Hash
c196250001cd07b526bc7f69b07f5762f929c35c358beb2b08142de736a84819
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://rootxone.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Thu, 04 May 2023 00:49:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Thu, 04 May 2023 00:49:41 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Thu, 04 May 2023 00:49:41 GMT
font-awesome.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ Frame 7448 		37 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css
Requested by
Host: rootxone.org
URL: https://rootxone.org/dff72/1/f7dff/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://rootxone.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 04 May 2023 00:49:41 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
538859
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
5884
last-modified
Mon, 04 May 2020 16:10:07 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e5f-9226"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R9OcgNzo6xtK9pkkxn0F7T9sF137Q7YWaFTJJhGVBQrAe8f0OGOLiOSRhFql3pou%2FU0K1%2FebSbn0KLncOUBNeTphZtYM1fj0kl6l83S82EpYX4OTkW4Y0ypfCjuDTgru5VbXp5XH"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7c1cbecb1956a813-SYD
expires
Tue, 23 Apr 2024 00:49:41 GMT
zocial.css
cdnjs.cloudflare.com/ajax/libs/css-social-buttons/1.2.0/css/ Frame 7448 		44 KB
21 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/css-social-buttons/1.2.0/css/zocial.css
Requested by
Host: rootxone.org
URL: https://rootxone.org/dff72/1/f7dff/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bf8d41c2e2250b2f0b431531871178d57cd9af1f42bbe121c90b51fd66a1dff2
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://rootxone.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 04 May 2023 00:49:41 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
67648
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
21543
last-modified
Mon, 04 May 2020 16:09:17 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e2d-ae99"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mFd6Ig7mFLHlSpKnADTUJ4EvupSQddqfrFBnQvaCgGynpVS0x6CyBvoijqRfj4p7JvFsSGTcdLXmVeVecVPC%2BZyOeqgbz7XNnO5B24DF%2B%2BFQ40NCdBrLgNDKpPSEZ9gS2sYLbKvq"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7c1cbecb1957a813-SYD
expires
Tue, 23 Apr 2024 00:49:41 GMT
style.css
rootxone.org/dff72/sourcexone/xonecss/ Frame 7448 		18 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://rootxone.org/dff72/sourcexone/xonecss/style.css
Requested by
Host: rootxone.org
URL: https://rootxone.org/dff72/1/f7dff/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.187.45 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a34fb4112dac269525802264dfe989c4bfce795635799fcc2f8726c0e2fb496f

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://rootxone.org/dff72/1/f7dff/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 04 May 2023 00:49:41 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Wed, 03 May 2023 12:41:01 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1373
etag
W/"4771-5fac95e4f66f4"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vpko9zJkw1q0jjqVsOVdMZPW3E0ikbDzVH7UOtcgmACx6UdliVPzF0S2IVskp1WYvyIAFXIBKro%2Bo4zwogH29ABtZZSflbfcspXeRnPmksJfm9rEB5YXgJU%2BwmY2b3c%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
7c1cbec9d8b3a894-SYD
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
stepbar.css
rootxone.org/dff72/sourcexone/xonecss/ Frame 7448 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://rootxone.org/dff72/sourcexone/xonecss/stepbar.css
Requested by
Host: rootxone.org
URL: https://rootxone.org/dff72/1/f7dff/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.187.45 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a1a0917eca00cbcf2fd9f9c97031af5035645e18718f8e6ba239bf69314bc081

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://rootxone.org/dff72/1/f7dff/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 04 May 2023 00:49:41 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Wed, 03 May 2023 12:41:01 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1373
etag
W/"db8-5fac95e4f6adc"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UBk57raBvBlfWG%2FCEgdQs3Q2kso2PkDvyJOCb6xH9xrB4xUji5FAmT8%2F%2BgUDk0fX67NJmhzhEHKhkuq8eI5iRSB9p%2FIg5Vxwu8%2F%2B%2FljcPgSKYYlu5w00eB6qwqFGqbI%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
7c1cbec9d8b7a894-SYD
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
rocket-loader.min.js
rootxone.org/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ Frame 7448 		12 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rootxone.org/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Requested by
Host: rootxone.org
URL: https://rootxone.org/dff72/1/f7dff/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.187.45 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://rootxone.org/dff72/1/f7dff/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 04 May 2023 00:49:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 25 Apr 2023 11:29:10 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"6447b986-302c"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nh5GSZcIS3qzFd9C4QlXxlN7d5ZG5fA%2FpB5mPVveiIyddTSAnl93QDyuLoMUjOkTk3G6VQDgKQRQqbSEorAKscdGev79NhGu89UjyWptumkLGUOpwtfg3UMBoCmwxDI%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
x-frame-options
DENY
cache-control
max-age=172800, public
cf-ray
7c1cbec9d8b8a894-SYD
expires
Sat, 06 May 2023 00:49:41 GMT
css
fonts.googleapis.com/ Frame 7448 		17 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Source+Code+Pro:400,500,600,700|Source+Sans+Pro:400,600,700&display=swap
Requested by
Host: rootxone.org
URL: https://rootxone.org/dff72/sourcexone/xonecss/style.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
74.125.24.95 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
sf-in-f95.1e100.net
Software
ESF /
Resource Hash
84fcfc904b2e41135ca0b0775f9b55f11c1af9cbb91b3bd52eabd29d915fa658
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://rootxone.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Thu, 04 May 2023 00:49:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Wed, 03 May 2023 23:49:48 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Thu, 04 May 2023 00:49:41 GMT
wz3xIB32v8DPajHZ
rootxone.me/pixel/ Frame 7448 		0
0
fontawesome-webfont.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/fonts/ Frame 7448 		75 KB
76 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d792afdac7f7ae5de7c6964950c6c61dc6e3f3813180a59e141c7cb4ac4364dc
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css
Origin
https://rootxone.org
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 04 May 2023 00:49:42 GMT
strict-transport-security
max-age=15780000
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
1747267
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
77160
last-modified
Mon, 04 May 2020 16:10:07 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e5f-12d68"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VLUuz5uWk61onhuUXE9vGb9ZJyCLBhuym6LI1aayUAqLqVgiDLYBJa%2B5WhRTWy6XrTYJAGYeob0CpfLM94oRFmKOdhF3iCIpNsZPnsMU5G1606G%2Bj%2FpwwkCp6iSWAgTA4tkCC7Mq"}],"group":"cf-nel","max_age":604800}
content-type
application/octet-stream; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7c1cbece2a5adfb5-SYD
expires
Tue, 23 Apr 2024 00:49:42 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
rootxone.me
URL
https://rootxone.me/pixel/wz3xIB32v8DPajHZ

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Optus (Telecommunication)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 boolean| credentialless function| savepage_ShadowLoader

0 Cookies

7 Console Messages

Source Level URL
Text
other warning URL: https://rootxone.org/dff72/1/f7dff/
Message:
Failed to decode downloaded font: data:text/plain;base64,bm90IGZvdW5k
other warning URL: https://rootxone.org/dff72/1/f7dff/
Message:
OTS parsing error: invalid sfntVersion: 1852797984
other warning URL: https://rootxone.org/dff72/1/f7dff/
Message:
Failed to decode downloaded font: data:text/plain;base64,bm90IGZvdW5k
other warning URL: https://rootxone.org/dff72/1/f7dff/
Message:
OTS parsing error: invalid sfntVersion: 1852797984
other warning URL: https://rootxone.org/dff72/1/f7dff/
Message:
Failed to decode downloaded font: data:text/plain;base64,bm90IGZvdW5k
other warning URL: https://rootxone.org/dff72/1/f7dff/
Message:
OTS parsing error: invalid sfntVersion: 1852797984
network error URL: https://rootxone.me/pixel/wz3xIB32v8DPajHZ
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED