tezlife.com Open in urlscan Pro
144.91.109.92 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://soo.gd/Xt1FE
Effective URL:
https://tezlife.com//.well-known/acme-challenge/ddh/F004f19441/11644210b.php?web=succes&local=_&id=47843669
Submission: On February 09 via api (February 9th 2021, 5:48:39 am UTC) from BG

Summary HTTP 21 Redirects Behaviour Indicators

Summary

This website contacted 9 IPs in 2 countries across 10 domains to perform 21 HTTP transactions. The main IP is 144.91.109.92, located in Germany and belongs to CONTABO, DE. The main domain is tezlife.com.
TLS certificate: Issued by R3 on January 27th 2021. Valid for: 3 months.

This is the only time tezlife.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
1	2606:4700:303... 2606:4700:3031::ac43:b9e8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2a00:1450:400... 2a00:1450:4001:811::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:800::2008	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:812::200e	15169 (GOOGLE) (GOOGLE)
2	142.250.185.194 142.250.185.194	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:812::2001	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:80f::2001	15169 (GOOGLE) (GOOGLE)
1 1	138.201.215.163 138.201.215.163	24940 (HETZNER-AS) (HETZNER-AS)
2 8	144.91.109.92 144.91.109.92	51167 (CONTABO) (CONTABO)
21	9

1 2606:4700:3031::ac43:b9e8 (United States)

ASN13335 (CLOUDFLARENET, US)

soo.gd	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:811::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:812::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cfe349cab5ea3b467fbf326ec0eb2b27.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 138.201.215.163 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: rea2.multiserver.gr

axiaasfalisis.gr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 144.91.109.92 (Germany) 2 redirects

ASN51167 (CONTABO, DE)
PTR: server.jobiba.com

tezlife.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	tezlife.com 2 redirects tezlife.com	191 KB
6	googlesyndication.com cfe349cab5ea3b467fbf326ec0eb2b27.safeframe.googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com	14 KB
2	doubleclick.net securepubads.g.doubleclick.net	102 KB
2	google-analytics.com www.google-analytics.com	19 KB
1	axiaasfalisis.gr 1 redirects axiaasfalisis.gr	261 B
1	google.com adservice.google.com	803 B
1	google.de adservice.google.de	803 B
1	googletagmanager.com www.googletagmanager.com	38 KB
1	googletagservices.com www.googletagservices.com	19 KB
1	soo.gd soo.gd	2 KB
21	10

	Domain	Requested by
8	tezlife.com	2 redirects soo.gd tezlife.com
3	tpc.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com
2	pagead2.googlesyndication.com	securepubads.g.doubleclick.net
2	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
1	axiaasfalisis.gr	1 redirects
1	cfe349cab5ea3b467fbf326ec0eb2b27.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	adservice.google.com	securepubads.g.doubleclick.net
1	adservice.google.de	securepubads.g.doubleclick.net
1	www.googletagmanager.com	soo.gd
1	www.googletagservices.com	soo.gd
1	soo.gd
21	12

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-09-19` - `2021-09-19`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2021-01-19` - `2021-04-13`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2021-01-19` - `2021-04-13`	3 months	crt.sh
*.google.de GTS CA 1O1	`2021-01-19` - `2021-04-13`	3 months	crt.sh
*.google.com GTS CA 1O1	`2021-01-19` - `2021-04-13`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2021-01-19` - `2021-04-13`	3 months	crt.sh
tezlife.com R3	`2021-01-27` - `2021-04-27`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://tezlife.com//.well-known/acme-challenge/ddh/F004f19441/11644210b.php?web=succes&local=_&id=47843669
Frame ID: 8EB8738AE8EEDA059624F3D42DF66720
Requests: 21 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html
Frame ID: 735F436E8887F6D72991FD7365489C03
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://soo.gd/Xt1FE Page URL
https://axiaasfalisis.gr/wp-admin/maint/rt/ HTTP 302
https://tezlife.com//.well-known/acme-challenge/ddh/ HTTP 302
https://tezlife.com//.well-known/acme-challenge/ddh/F004f19441/index.php?valid=true&id=34360924 HTTP 302
https://tezlife.com//.well-known/acme-challenge/ddh/F004f19441/11644210b.php?web=succes&local=_&... Page URL

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

21
Requests

100 %
HTTPS

67 %
IPv6

10
Domains

12
Subdomains

9
IPs

2
Countries

404 kB
Transfer

931 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://soo.gd/Xt1FE Page URL
https://axiaasfalisis.gr/wp-admin/maint/rt/ HTTP 302
https://tezlife.com//.well-known/acme-challenge/ddh/ HTTP 302
https://tezlife.com//.well-known/acme-challenge/ddh/F004f19441/index.php?valid=true&id=34360924 HTTP 302
https://tezlife.com//.well-known/acme-challenge/ddh/F004f19441/11644210b.php?web=succes&local=_&id=47843669 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Xt1FE Show response
soo.gd/ 3 KB
2 KB 1685ms
1668ms Document
text/html 2606:4700:3031::ac43:b9e8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://soo.gd/Xt1FE

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3031::ac43:b9e8 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

664abd1251d1f4862bcbe367763553ff4b0fb2407d3f1237393dfd1fc018b11c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Request headers

:method: GET
:authority: soo.gd
:scheme: https
:path: /Xt1FE
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 09 Feb 2021 05:48:21 GMT
content-type: text/html; Charset=UTF-8;charset=UTF-8
set-cookie: __cfduid=da88cc06f46b2f79c2129c2fa84bf00371612849699; expires=Thu, 11-Mar-21 05:48:19 GMT; path=/; domain=.soo.gd; HttpOnly; SameSite=Lax; Secure
vary: Accept-Encoding
cache-control: no-cache, must-revalidate, max-age=0
pragma: no-cache
x-robots-tag: noindex, nofollow
i-am: Alpha
strict-transport-security: max-age=31536000; includeSubdomains;
cf-cache-status: DYNAMIC
cf-request-id: 0826ee746b00004a68dfab1000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ZsA8rUUQFc5SBFg0JAxohUot7MoPYHuRlShj3fA5%2BAcFSVb2lDuTZNUpuPQ92zRK32xGgwuHUBGMIKCF4boxK8wNX6rADvWz43s1knbNYWDBkNU%3D"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 61eb4d00abd94a68-FRA
content-encoding: br

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 55 KB
19 KB 33ms
14ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: soo.gd
URL: https://soo.gd/Xt1FE

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de89ec397e851b23e7e27f01ab09177ec0b05967cc2d9f5118a90cf5f5bda184

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://soo.gd/Xt1FE
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 09 Feb 2021 05:48:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "778 / 948 of 1000 / last-modified: 1612825835"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 19049
x-xss-protection: 0
expires: Tue, 09 Feb 2021 05:48:21 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 97 KB
38 KB 14ms
14ms Script
application/javascript 2a00:1450:4001:800::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-31510493-2

Requested by

Host: soo.gd
URL: https://soo.gd/Xt1FE

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b6fba245df50ad5ebe5e98f85faae28f87767546b29f66cce1299ed18bfff074

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://soo.gd/Xt1FE
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 09 Feb 2021 05:48:21 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39001
x-xss-protection: 0
last-modified: Tue, 09 Feb 2021 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 09 Feb 2021 05:48:21 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 46 KB
18 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:812::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-31510493-2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://soo.gd/Xt1FE
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 23 Oct 2020 03:00:57 GMT
server: Golfe2
age: 1394
date: Tue, 09 Feb 2021 05:25:07 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18817
expires: Tue, 09 Feb 2021 07:25:07 GMT

GET
H2 200 pubads_impl_2021020401.js Show response
securepubads.g.doubleclick.net/gpt/ 288 KB
101 KB 102ms
41ms Script
text/javascript 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021020401.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

sffe /

Resource Hash

6f6a7567f47eb32ec69d095bdfa4e0a4d841ce95a01a40836a028d8a31d44821

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://soo.gd/Xt1FE
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 09 Feb 2021 05:48:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 04 Feb 2021 09:37:11 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 103372
x-xss-protection: 0
expires: Tue, 09 Feb 2021 05:48:21 GMT

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 1 B
58 B 13ms
13ms XHR
text/plain 2a00:1450:4001:812::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j87&a=924894451&t=pageview&_s=1&dl=https%3A%2F%2Fsoo.gd%2FXt1FE&ul=en-us&de=UTF-8&dt=Xt1FE&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUABAAAAAC~&jid=1471998726&gjid=1164513611&cid=589105054.1612849702&tid=UA-31510493-2&_gid=1833070745.1612849702&_r=1&gtm=2ou1r0&z=177150768

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://soo.gd/Xt1FE
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 09 Feb 2021 05:48:21 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://soo.gd
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 integrator.js
adservice.google.de/adsid/ 109 B
803 B 47ms
27ms Script
application/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=soo.gd

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021020401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://soo.gd/Xt1FE
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 09 Feb 2021 05:48:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 109 B
803 B 46ms
27ms Script
application/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=soo.gd

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021020401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://soo.gd/Xt1FE
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 09 Feb 2021 05:48:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H3-Q050 200 ads
securepubads.g.doubleclick.net/gampad/ 435 B
937 B 100ms
66ms XHR
text/plain 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4076520745129766&correlator=496406389459195&output=ldjh&impl=fif&eid=21068773%2C21068891%2C21069971&vrg=2021020401&ptt=17&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20210209&iu_parts=5837603%2CSGD_360&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x360&cookie_enabled=1&bc=31&abxe=1&lmt=1612849701&dt=1612849701845&dlt=1612849701614&idt=214&frm=20&biw=1600&bih=1200&oid=3&adxs=-12245933&adys=-12245933&adks=1216140633&ucis=1&ifi=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fsoo.gd%2FXt1FE&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x423&msz=0x0&ga_vid=589105054.1612849702&ga_sid=1612849702&ga_hid=924894451&fws=128&ohw=0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021020401.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://soo.gd/Xt1FE
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 09 Feb 2021 05:48:21 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 229
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://soo.gd
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html
cfe349cab5ea3b467fbf326ec0eb2b27.safeframe.googlesyndication.com/safeframe/1-0-37/html/ 0
0 59ms
14ms Other
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://cfe349cab5ea3b467fbf326ec0eb2b27.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021020401.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://soo.gd/Xt1FE
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ 0
0 25ms
6ms Other
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021020401.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://soo.gd/Xt1FE
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H2

200

Primary Request 11644210b.php Show response
tezlife.com//.well-known/acme-challenge/ddh/F004f19441/
Redirect Chain

https://axiaasfalisis.gr/wp-admin/maint/rt/
https://tezlife.com//.well-known/acme-challenge/ddh/
https://tezlife.com//.well-known/acme-challenge/ddh/F004f19441/index.php?valid=true&id=34360924
https://tezlife.com//.well-known/acme-challenge/ddh/F004f19441/11644210b.php?web=succes&local=_&id=47843669

4 KB
2 KB

35ms
35ms

Document
text/html

144.91.109.92
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL: https://tezlife.com//.well-known/acme-challenge/ddh/F004f19441/11644210b.php?web=succes&local=_&id=47843669
Requested by: Host: soo.gd
URL: https://soo.gd/Xt1FE
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 144.91.109.92 , Germany, ASN51167 (CONTABO, DE),
Reverse DNS: server.jobiba.com
Software: LiteSpeed /
Resource Hash: 91aa6929ac8f1a18e4798ab5650b3328d9775d2bbd91534360d7bfb557bc284f

Request headers

:method: GET
:authority: tezlife.com
:scheme: https
:path: //.well-known/acme-challenge/ddh/F004f19441/11644210b.php?web=succes&local=_&id=47843669
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://soo.gd/Xt1FE
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: PHPSESSID=el339rub9o8mfpfbvotkreqs17
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://soo.gd/Xt1FE

Response headers

expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
content-type: text/html; charset-UTF-8;charset=UTF-8
content-encoding: gzip
vary: Accept-Encoding
content-length: 1637
date: Tue, 09 Feb 2021 05:48:23 GMT
server: LiteSpeed
alt-svc: quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000

Redirect headers

expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
content-type: text/html; charset-UTF-8;charset=UTF-8
location: ./11644210b.php?web=succes&local=_&id=47843669
content-encoding: gzip
vary: Accept-Encoding
content-length: 320
date: Tue, 09 Feb 2021 05:48:23 GMT
server: LiteSpeed
alt-svc: quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000

GET
H2 200 sodar
pagead2.googlesyndication.com/getconfig/ 9 KB
7 KB 56ms
37ms XHR
application/json 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021020401&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021020401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://soo.gd/Xt1FE
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 09 Feb 2021 05:48:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 6901
x-xss-protection: 0

GET
H3-Q050 200 sodar2.js
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 34ms
21ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021020401.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://soo.gd/Xt1FE
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 09 Feb 2021 05:48:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1611170586013198"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6403
x-xss-protection: 0
expires: Tue, 09 Feb 2021 05:48:22 GMT

GET
H3-Q050 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/221/ Frame 735F 0
0 6ms
6ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/221/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://soo.gd/Xt1FE
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://soo.gd/Xt1FE

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 4984
date: Mon, 08 Feb 2021 21:46:33 GMT
expires: Tue, 08 Feb 2022 21:46:33 GMT
last-modified: Tue, 08 Dec 2020 21:41:15 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 28909
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
224 B 43ms
43ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=221&t=2&li=gpt_2021020401&jk=4076520745129766&bg=!TE-lTwzNAAWP4B5EjzsAKQB2-DxaAo4O-M2R-g6xmRcBHqOr8wOzi_cKV9wt5FFDH2Y8tPIPW9Y-AgAAAE1SAAAAC2gBBwoA_SCemXsqadg9bf5Wb4pF_dWdLQY08j3yQWAn6dV7aGRmO8XaOylwkTVCmY0PrtQnwKrjfQ4HQXYIjoBtNgaims6sUqziDQE9mul5ihN536vfzpZhrZY5eW-NhmCf5PFmzVY6h7eHk7kw9Ed06zSoqBoIwwUKeBWh06c1yvhmCb20JJWsmMiP322hmO5OLAfdFSvw4VxTPPDEadwfifVCZeQlyzdnTeT2MPszgOVfxki_MQ67-XXO7B5sk2Ei1Mguh2Ev-14woH5gMWpFRwWhWlYPHprakLUbaj6SuEz3yoT5g-S8dHcrn8tqZFvxOWGw7X4TmhDtVs8WUCF93xWZAeBHvwMfjw4VPTE5QRAn-BlxVmb5ZLvuH7AIUDNv2-U3ikTE_EPxuas6AAf0n5G-SzT-JLPle0UZAlyLlwdJdshpDbUoYtPM6Gj0V69g47XyhxfJGQd-oIwux2Oti31CM6koqnyAeq6yHbQ_BnOAMKQbEJMRYR_CLJnYL2Nvj7Tst_oqXNNp2swAwcjHRaHu1hUdB0h-G-gPgstoMnXPZBiHjAU75sOLALg1vADP4hXIE7WuFC4_QlxUzLmPVzb2MVG0j5RuJ195hCaxBSShnWhJxABbBbYdT8XIfNjIfIUmNfKcXWnVmv3kzL8Vu7m3SGR_t3Ubt3hQrTpOtSFgx39ajR5edtRWP5dMBj1WXtiBIXzO76Vj3OB72INd0jmaQJRC6GPwPKnTKrtYvGiUkNIxzCdDTtY6ZGWep6qf0lyABFYhQCyOjWjVWg8Vl0RJOhGsEHIRS7MNgIaUybn-oWVBvvu2YMAjYuWgjgTJpsS0ZQhXC7u-xFUZFBO6l_qxIxV_cL6HaC5gjnQlucBrYGpVowexeVSDVkxYNkufM5ifAvw3UItKy-DVicwbK39SkZaImfZ4V8uaOYqd_ntIgjPuY5iJYoolbY_RkvXNaKE8UGLLNDwf27U2yOld9qq1Afc

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://soo.gd/Xt1FE
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 09 Feb 2021 05:48:22 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 style.css
tezlife.com//.well-known/acme-challenge/ddh/F004f19441/layout/css/ 209 KB
67 KB 52ms
50ms Stylesheet
text/css 144.91.109.92
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL: https://tezlife.com//.well-known/acme-challenge/ddh/F004f19441/layout/css/style.css
Requested by: Host: tezlife.com
URL: https://tezlife.com//.well-known/acme-challenge/ddh/F004f19441/11644210b.php?web=succes&local=_&id=47843669
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 144.91.109.92 , Germany, ASN51167 (CONTABO, DE),
Reverse DNS: server.jobiba.com
Software: LiteSpeed /
Resource Hash: 993198ae94d90e3ea850f7d6b70443b64cf5f817098c778821edf924c297eea3

Request headers

Referer: https://tezlife.com//.well-known/acme-challenge/ddh/F004f19441/11644210b.php?web=succes&local=_&id=47843669
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 09 Feb 2021 05:48:23 GMT
content-encoding: br
last-modified: Mon, 08 Feb 2021 15:01:50 GMT
server: LiteSpeed
etag: "34299-6021525e-c80148;br"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000
content-length: 68036
expires: Tue, 16 Feb 2021 05:48:23 GMT

GET
H2 200 style.js Show response
tezlife.com//.well-known/acme-challenge/ddh/F004f19441/layout/js/ 96 KB
33 KB 84ms
82ms Script
application/x-javascript 144.91.109.92
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL: https://tezlife.com//.well-known/acme-challenge/ddh/F004f19441/layout/js/style.js
Requested by: Host: tezlife.com
URL: https://tezlife.com//.well-known/acme-challenge/ddh/F004f19441/11644210b.php?web=succes&local=_&id=47843669
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 144.91.109.92 , Germany, ASN51167 (CONTABO, DE),
Reverse DNS: server.jobiba.com
Software: LiteSpeed /
Resource Hash: b56dd0f5e443608e46b42696f86fe376190c1688f2586cf5345b0b43f2973a5c

Request headers

Referer: https://tezlife.com//.well-known/acme-challenge/ddh/F004f19441/11644210b.php?web=succes&local=_&id=47843669
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 09 Feb 2021 05:48:23 GMT
content-encoding: br
last-modified: Mon, 08 Feb 2021 15:01:50 GMT
server: LiteSpeed
etag: "17f6f-6021525e-c8015b;br"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000
content-length: 33437
expires: Tue, 16 Feb 2021 05:48:23 GMT

GET
H2 200 lg.svg
tezlife.com//.well-known/acme-challenge/ddh/F004f19441/layout/img/ 2 KB
751 B 93ms
91ms Image
image/svg+xml 144.91.109.92
CONTABO

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tezlife.com//.well-known/acme-challenge/ddh/F004f19441/layout/img/lg.svg
Requested by: Host: tezlife.com
URL: https://tezlife.com//.well-known/acme-challenge/ddh/F004f19441/11644210b.php?web=succes&local=_&id=47843669
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 144.91.109.92 , Germany, ASN51167 (CONTABO, DE),
Reverse DNS: server.jobiba.com
Software: LiteSpeed /
Resource Hash: aeed178a287002e32c4a7767dc24b3c732a812cdd42017835055e42db4d2eae1

Request headers

Referer: https://tezlife.com//.well-known/acme-challenge/ddh/F004f19441/11644210b.php?web=succes&local=_&id=47843669
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 09 Feb 2021 05:48:23 GMT
content-encoding: br
last-modified: Mon, 08 Feb 2021 15:01:50 GMT
server: LiteSpeed
etag: "7f8-6021525e-c8014e;br"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000
content-length: 672
expires: Tue, 16 Feb 2021 05:48:23 GMT

GET
H2 200 pub.jpg
tezlife.com//.well-known/acme-challenge/ddh/F004f19441/layout/img/ 80 KB
80 KB 94ms
93ms Image
image/jpeg 144.91.109.92
CONTABO

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tezlife.com//.well-known/acme-challenge/ddh/F004f19441/layout/img/pub.jpg
Requested by: Host: tezlife.com
URL: https://tezlife.com//.well-known/acme-challenge/ddh/F004f19441/11644210b.php?web=succes&local=_&id=47843669
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 144.91.109.92 , Germany, ASN51167 (CONTABO, DE),
Reverse DNS: server.jobiba.com
Software: LiteSpeed /
Resource Hash: fd6d79b881550d2aced201e506cbd7dfacafc19c16db81a655ad06f2835819c5

Request headers

Referer: https://tezlife.com//.well-known/acme-challenge/ddh/F004f19441/11644210b.php?web=succes&local=_&id=47843669
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 09 Feb 2021 05:48:23 GMT
last-modified: Mon, 08 Feb 2021 15:01:50 GMT
server: LiteSpeed
etag: "140d5-6021525e-c80156;;;"
content-type: image/jpeg
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000
content-length: 82133
expires: Tue, 16 Feb 2021 05:48:23 GMT

GET
H2 200 pubr.gif
tezlife.com//.well-known/acme-challenge/ddh/F004f19441/layout/img/ 8 KB
8 KB 105ms
104ms Image
image/gif 144.91.109.92
CONTABO

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tezlife.com//.well-known/acme-challenge/ddh/F004f19441/layout/img/pubr.gif
Requested by: Host: tezlife.com
URL: https://tezlife.com//.well-known/acme-challenge/ddh/F004f19441/11644210b.php?web=succes&local=_&id=47843669
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 144.91.109.92 , Germany, ASN51167 (CONTABO, DE),
Reverse DNS: server.jobiba.com
Software: LiteSpeed /
Resource Hash: 38d38e7a9e31f364cf1238ed6efcad478b3d71b56a8070c7aeda136e7a09dfa6

Request headers

Referer: https://tezlife.com//.well-known/acme-challenge/ddh/F004f19441/11644210b.php?web=succes&local=_&id=47843669
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 09 Feb 2021 05:48:23 GMT
last-modified: Mon, 08 Feb 2021 15:01:50 GMT
server: LiteSpeed
etag: "2098-6021525e-c80157;;;"
content-type: image/gif
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000
content-length: 8344
expires: Tue, 16 Feb 2021 05:48:23 GMT

GET
DATA 200
OK truncated
/ 17 KB
17 KB Font
application/font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 79b6bfed5b8e93eafbc4b6cc1aeb1a66256446899c27bfb099fc336fb59d3171

Request headers

Origin: https://tezlife.com
Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: application/font-woff2;charset=utf-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			tezlife.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: el339rub9o8mfpfbvotkreqs17

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
axiaasfalisis.gr
cfe349cab5ea3b467fbf326ec0eb2b27.safeframe.googlesyndication.com
pagead2.googlesyndication.com
securepubads.g.doubleclick.net
soo.gd
tezlife.com
tpc.googlesyndication.com
www.google-analytics.com
www.googletagmanager.com
www.googletagservices.com
138.201.215.163
142.250.185.194
144.91.109.92
2606:4700:3031::ac43:b9e8
2a00:1450:4001:800::2008
2a00:1450:4001:80f::2001
2a00:1450:4001:811::2002
2a00:1450:4001:812::2001
2a00:1450:4001:812::200e
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
38d38e7a9e31f364cf1238ed6efcad478b3d71b56a8070c7aeda136e7a09dfa6
664abd1251d1f4862bcbe367763553ff4b0fb2407d3f1237393dfd1fc018b11c
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6f6a7567f47eb32ec69d095bdfa4e0a4d841ce95a01a40836a028d8a31d44821
79b6bfed5b8e93eafbc4b6cc1aeb1a66256446899c27bfb099fc336fb59d3171
91aa6929ac8f1a18e4798ab5650b3328d9775d2bbd91534360d7bfb557bc284f
993198ae94d90e3ea850f7d6b70443b64cf5f817098c778821edf924c297eea3
aeed178a287002e32c4a7767dc24b3c732a812cdd42017835055e42db4d2eae1
b56dd0f5e443608e46b42696f86fe376190c1688f2586cf5345b0b43f2973a5c
b6fba245df50ad5ebe5e98f85faae28f87767546b29f66cce1299ed18bfff074
de89ec397e851b23e7e27f01ab09177ec0b05967cc2d9f5118a90cf5f5bda184
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
fd6d79b881550d2aced201e506cbd7dfacafc19c16db81a655ad06f2835819c5

tezlife.com Open in urlscan Pro 144.91.109.92 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

21 Requests

100 %HTTPS

67 %IPv6

10 Domains

12 Subdomains

9 IPs

2 Countries

404 kBTransfer

931 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

21 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

15 JavaScript Global Variables

1 Cookies

Security Headers

Indicators

tezlife.com Open in urlscan Pro
144.91.109.92 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

21
Requests

100 %
HTTPS

67 %
IPv6

10
Domains

12
Subdomains

9
IPs

2
Countries

404 kB
Transfer

931 kB
Size

1
Cookies

21 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!