Submitted URL: https://doubtflap.top/8w9Xol88Unym?lvoo1699608074652
Effective URL: https://v7183.qozf.sbs/go.php?ad=dpmly88mjyqsa7zl6x30&sid=M7299762408124317785&pub=25426&pid=25426-5a4e140z&c=0&app=unk...
Submission: On November 10 via manual from RU — Scanned from DE

Summary

This website contacted 5 IPs in 2 countries across 5 domains to perform 7 HTTP transactions. The main IP is 162.55.4.52, located in Germany and belongs to HETZNER-AS, DE. The main domain is v7183.qozf.sbs.
TLS certificate: Issued by R3 on September 16th 2023. Valid for: 3 months.
This is the only time v7183.qozf.sbs was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 2606:4700:303... 13335 (CLOUDFLAR...)
1 2a06:98c1:312... 13335 (CLOUDFLAR...)
2 108.178.23.114 32475 (SINGLEHOP...)
1 162.55.4.52 24940 (HETZNER-AS)
7 5
Domain Requested by
2 prize.youarelucky.click ad.admo.buzz
prize.youarelucky.click
2 doubtflap.top doubtflap.top
1 v7183.qozf.sbs prize.youarelucky.click
1 ad.admo.buzz doubtflap.top
0 hm.baidu.com Failed doubtflap.top
7 5

This site contains no links.

Subject Issuer Validity Valid
doubtflap.top
GTS CA 1P5
2023-11-04 -
2024-02-02
3 months crt.sh
admo.buzz
E1
2023-10-18 -
2024-01-16
3 months crt.sh
prize.youarelucky.click
R3
2023-10-11 -
2024-01-09
3 months crt.sh
v7183.qozf.sbs
R3
2023-09-16 -
2023-12-15
3 months crt.sh

This page contains 1 frames:

Primary Page: https://v7183.qozf.sbs/go.php?ad=dpmly88mjyqsa7zl6x30&sid=M7299762408124317785&pub=25426&pid=25426-5a4e140z&c=0&app=unknown&br=Chrome&os=[[os]]&d=Google+Chrome&ca=DE+WiFi&a=0
Frame ID: F2ACC1A5611BB1D8B47CBDC460BEBF1F
Requests: 7 HTTP requests in this frame

Screenshot

Page Title

all we this those have only see in by there who from about be no say so well

Page URL History Show full URLs

  1. https://doubtflap.top/8w9Xol88Unym?lvoo1699608074652 Page URL
  2. https://doubtflap.top/404/nfp.html Page URL
  3. https://ad.admo.buzz/mt/?pn=nfp Page URL
  4. https://prize.youarelucky.click/?utm_medium=c7069e939b860228ac9c4f5b0798b92843c0aa3c&utm_campaign=nfpf&4=22 Page URL
  5. https://prize.youarelucky.click/proc.php?0c5fffb6032ab265152129cd5ffb3884d34219a8 Page URL
  6. https://v7183.qozf.sbs/go.php?ad=dpmly88mjyqsa7zl6x30&sid=M7299762408124317785&pub=25426&pid=25426-... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

7
Requests

86 %
HTTPS

50 %
IPv6

5
Domains

5
Subdomains

5
IPs

2
Countries

160 kB
Transfer

165 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://doubtflap.top/8w9Xol88Unym?lvoo1699608074652 Page URL
  2. https://doubtflap.top/404/nfp.html Page URL
  3. https://ad.admo.buzz/mt/?pn=nfp Page URL
  4. https://prize.youarelucky.click/?utm_medium=c7069e939b860228ac9c4f5b0798b92843c0aa3c&utm_campaign=nfpf&4=22 Page URL
  5. https://prize.youarelucky.click/proc.php?0c5fffb6032ab265152129cd5ffb3884d34219a8 Page URL
  6. https://v7183.qozf.sbs/go.php?ad=dpmly88mjyqsa7zl6x30&sid=M7299762408124317785&pub=25426&pid=25426-5a4e140z&c=0&app=unknown&br=Chrome&os=[[os]]&d=Google+Chrome&ca=DE+WiFi&a=0 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
8w9Xol88Unym
doubtflap.top/
1 KB
1 KB
Document
General
Full URL
https://doubtflap.top/8w9Xol88Unym?lvoo1699608074652
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::ac43:c7a0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-headers
X-Requested-With,X_Requested_With,X-PINGOTHER,Content-Type
access-control-allow-methods
POST,GET,OPTIONS
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
823d40d34c9c1941-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Fri, 10 Nov 2023 09:26:19 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LnNdBFY4rWGTbby2tMMpg%2Fm6EA0hNVaZH31ZEwpGn4ehm9evn%2FZG0Avhh3oxBGY%2BCUSto1cbBaoH%2BWpiTXx683ZeK7ryV8WDGfFF6Td%2BnqCKk0VoltFyMVR9ZYGLAwaoS30nQwY70aB6Z6oR"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
nfp.html
doubtflap.top/404/
836 B
719 B
Document
General
Full URL
https://doubtflap.top/404/nfp.html
Requested by
Host: doubtflap.top
URL: https://doubtflap.top/8w9Xol88Unym?lvoo1699608074652
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::ac43:c7a0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
823d40d40da41941-FRA
content-encoding
br
content-type
text/html
date
Fri, 10 Nov 2023 09:26:19 GMT
last-modified
Sat, 21 Oct 2023 05:35:06 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rGLIuLtUlG%2F3lNG3gyCE59CCj2md6lbMfJ%2BI%2BIYxoZoU90vuoRIu5noLQbXExZ%2BLJuTw8x98yIrwArq8ArNW55bJKSFQTnyTZl3YTEt9CeEb07dVv3XPhZK2yzbglP%2Bm5gawVFJdw4k9wkuf"}],"group":"cf-nel","max_age":604800}
server
cloudflare
hm.js
hm.baidu.com/
0
0

/
ad.admo.buzz/mt/
179 B
599 B
Document
General
Full URL
https://ad.admo.buzz/mt/?pn=nfp
Requested by
Host: doubtflap.top
URL: https://doubtflap.top/404/nfp.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://doubtflap.top/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
823d40d69a323a7e-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Fri, 10 Nov 2023 09:26:19 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rtj2akm0ZmQ%2F8d1J0Q7tc8XZY6uRUO%2F84aF8mf3r0cQvZjmrkznam7vZnqkoZIouEr%2FmFxFcbrCkgMzfTJFACbGV13%2Be%2BaKFeMiw0L2zfhmYXuNli1UX6h596GM3IoXqL2OvIFhnKtMjFw0%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
/
prize.youarelucky.click/
8 KB
3 KB
Document
General
Full URL
https://prize.youarelucky.click/?utm_medium=c7069e939b860228ac9c4f5b0798b92843c0aa3c&utm_campaign=nfpf&4=22
Requested by
Host: ad.admo.buzz
URL: https://ad.admo.buzz/mt/?pn=nfp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.178.23.114 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
server04.com-2.mobi
Software
nginx / PHP/8.2.12
Resource Hash
7e0c2fb46ffda93d37e5e4cd4f223717db2b5b100872a631fa8d6f7539a35643

Request headers

Referer
https://ad.admo.buzz/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ch
Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version
cache-control
no-store, no-cache, must-revalidate, max-age=0
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Fri, 10 Nov 2023 09:26:20 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
pragma
no-cache
server
nginx
vary
Accept-Encoding
x-powered-by
PHP/8.2.12
proc.php
prize.youarelucky.click/
1 KB
1 KB
Document
General
Full URL
https://prize.youarelucky.click/proc.php?0c5fffb6032ab265152129cd5ffb3884d34219a8
Requested by
Host: prize.youarelucky.click
URL: https://prize.youarelucky.click/?utm_medium=c7069e939b860228ac9c4f5b0798b92843c0aa3c&utm_campaign=nfpf&4=22
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.178.23.114 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
server04.com-2.mobi
Software
nginx / PHP/8.2.12
Resource Hash

Request headers

Referer
https://prize.youarelucky.click/?utm_medium=c7069e939b860228ac9c4f5b0798b92843c0aa3c&utm_campaign=nfpf&4=22
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ch
Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version
cache-control
no-store, no-cache, must-revalidate, max-age=0
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Fri, 10 Nov 2023 09:26:20 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
location
https://v7183.qozf.sbs/go.php?ad=dpmly88mjyqsa7zl6x30&sid=M7299762408124317785&pub=25426&pid=25426-5a4e140z&c=0&app=unknown&br=Chrome&os=[[os]]&d=Google+Chrome&ca=DE+WiFi&a=0
pragma
no-cache
server
nginx
vary
Accept-Encoding
x-powered-by
PHP/8.2.12
Primary Request go.php
v7183.qozf.sbs/
152 KB
153 KB
Document
General
Full URL
https://v7183.qozf.sbs/go.php?ad=dpmly88mjyqsa7zl6x30&sid=M7299762408124317785&pub=25426&pid=25426-5a4e140z&c=0&app=unknown&br=Chrome&os=[[os]]&d=Google+Chrome&ca=DE+WiFi&a=0
Requested by
Host: prize.youarelucky.click
URL: https://prize.youarelucky.click/proc.php?0c5fffb6032ab265152129cd5ffb3884d34219a8
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, CHACHA20_POLY1305
Server
162.55.4.52 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.52.4.55.162.clients.your-server.de
Software
nginx/1.24.0 /
Resource Hash
5138b5ba1a6495778419ff1ec2cc118908f690503ad1063154deb647530f84fe
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://prize.youarelucky.click/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Date
Fri, 10 Nov 2023 09:26:21 GMT
Server
nginx/1.24.0
Strict-Transport-Security
max-age=31536000
Transfer-Encoding
chunked

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
hm.baidu.com
URL
https://hm.baidu.com/hm.js?e6d5c1513b650adee00ba52513a6c25c

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ad.admo.buzz
doubtflap.top
hm.baidu.com
prize.youarelucky.click
v7183.qozf.sbs
hm.baidu.com
108.178.23.114
162.55.4.52
2606:4700:3035::ac43:c7a0
2a06:98c1:3121::3
5138b5ba1a6495778419ff1ec2cc118908f690503ad1063154deb647530f84fe
7e0c2fb46ffda93d37e5e4cd4f223717db2b5b100872a631fa8d6f7539a35643