xtermore.com Open in urlscan Pro
172.67.179.14  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response xtermore.com/	7 KB 3 KB	1221ms 597ms	Document text/html	172.67.179.14 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://xtermore.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.179.14 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 948964f18da76a83569929e01bbb08c6108a24daa2eb8ea93575f80eb31573a3 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers cache-control no-store cf-cache-status DYNAMIC cf-ray 8cafa02cdfadbacf-MXP content-encoding br content-type text/html; charset=UTF-8 date Sun, 29 Sep 2024 23:06:47 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Jg8EYVKk5UCBkWQOS5jcs%2FCeTIAliZqpqrPEEzedm6VrOvRFMEiLiN3m2gaEWdqqcHtk4vfswLN%2FkcTXbRPAkulf08EupHFnKF92TiX0hQoHMz15Pni906V%2BGVTVpDw%3D"}],"group":"cf-nel","max_age":604800} server cloudflare speculation-rules "/cdn-cgi/speculation" vary Accept-Encoding
GET H2	200	speculation xtermore.com/cdn-cgi/	128 B 454 B	99ms 97ms	Other application/speculationrules+json	172.67.179.14 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://xtermore.com/cdn-cgi/speculation Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.179.14 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://xtermore.com Referer https://xtermore.com/ Response headers nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=huhli%2BNFJULweN4p3zqFpNZKR1Ubpomk2avN7ZrYXswTtLfhkCzbxKg%2Bd%2F5z52pYOrZSDswKttUBMMAuUj9xDVrNGK7j3GQnzrM3HkFvzaGoQypQ%2BMRMPLUhKT3bdog%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8cafa030dacfbacf-MXP access-control-allow-origin https://xtermore.com content-length 128 date Sun, 29 Sep 2024 23:06:47 GMT content-type application/speculationrules+json vary Origin, Accept-Encoding server cloudflare
GET H/1.1	200 OK	main.css cdn-bimi.akamaized.net/landings/188578/1595417073/css/	17 KB 3 KB	649ms 450ms	Stylesheet text/css	23.207.210.96 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://cdn-bimi.akamaized.net/landings/188578/1595417073/css/main.css?1595417073 Requested by Host: xtermore.com URL: https://xtermore.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 23.207.210.96 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-207-210-96.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 492d8e4c856f589d7395a8c61f152e3840e21dbad322602008c173ee2180765c Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://xtermore.com/ Response headers Content-Encoding gzip ETag "a8d7ab7953dd2a2c2a0fb8dbf3d78c1b" Connection keep-alive x-amz-request-id 9JB0X2PZ6ZGFA3MM Accept-Ranges bytes Alt-Svc h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" Content-Length 2963 Date Sun, 29 Sep 2024 23:06:48 GMT Last-Modified Wed, 22 Jul 2020 11:24:36 GMT Vary Accept-Encoding Server AmazonS3 Content-Type text/css x-amz-id-2 G9X6ZG658ZtXOkbbAgFUk+yw8IWB6WCWl6iu9j40kMTNkwYJPTtYu6gOjeDbaLenL7waQTG6Wcg=
GET H/1.1	200 OK	script.min.js Show response cdn-bimi.akamaized.net/landings/188578/1595417073/js/	252 KB 75 KB	654ms 405ms	Script text/javascript	23.207.210.96 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://cdn-bimi.akamaized.net/landings/188578/1595417073/js/script.min.js?1595417073 Requested by Host: xtermore.com URL: https://xtermore.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 23.207.210.96 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-207-210-96.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 322d600431f53fb186989dad7e4ed1365b0d3012a808cd114390855a0dce16a6 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://xtermore.com/ Response headers Transfer-Encoding chunked Content-Encoding gzip ETag "28c2e529f18ba1afa7f17dc8776448d0" Connection keep-alive, Transfer-Encoding x-amz-request-id PP90RTXCBNW5T276 Accept-Ranges bytes Alt-Svc h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" Date Sun, 29 Sep 2024 23:06:48 GMT Last-Modified Wed, 22 Jul 2020 11:24:36 GMT Vary Accept-Encoding Server AmazonS3 Content-Type text/javascript x-amz-id-2 oe/ltnb6lYse+PMdf+Lmie5CbE5/JgrTgHvpb+7h8eYaycnr6HLHY2ZEcEB6LTH/R7QIx5+k6lA=
GET H/1.1	200 OK	function.js Show response cdn-bimi.akamaized.net/landings/188578/1595417073/js/	768 B 1 KB	382ms 172ms	Script text/javascript	23.207.210.96 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://cdn-bimi.akamaized.net/landings/188578/1595417073/js/function.js?1595417073 Requested by Host: xtermore.com URL: https://xtermore.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 23.207.210.96 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-207-210-96.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash c4e62e899d387cd5be4770f35d30a90a4a0b7690e5a70fe510d61192a55df2fb Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://xtermore.com/ Response headers ETag "26b0713adea8f1ba936e44ca1dde0b9c" Connection keep-alive x-amz-request-id 99HQ6NPZ6AJZMDTV Accept-Ranges bytes Alt-Svc h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" Content-Length 768 Date Sun, 29 Sep 2024 23:06:48 GMT Last-Modified Wed, 22 Jul 2020 11:24:36 GMT Content-Type text/javascript Server AmazonS3 x-amz-id-2 O4pq0wHNYhUEIYnwGHNT1fEs2mP8wMX3NFl+HBgN2t7CsBRCAAeGyipCj++Z+54l/KhnW2CoxF/ZyuEuFHK/NmRgoQeKx1WguUXV64YL0pQ=
GET H/1.1	200 OK	translate.js Show response cdn-bimi.akamaized.net/landings/188578/1595417073/js/	20 KB 9 KB	366ms 154ms	Script text/javascript	23.207.210.96 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://cdn-bimi.akamaized.net/landings/188578/1595417073/js/translate.js?1595417073 Requested by Host: xtermore.com URL: https://xtermore.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 23.207.210.96 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-207-210-96.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 0aa575ab7a50d63721a0bdc438eb3b4e627e372256c9e7007ae2523f02d191e3 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://xtermore.com/ Response headers Content-Encoding gzip ETag "cf2d0554e35d77b3b6c00a8d6e2ec90f" Connection keep-alive x-amz-request-id XXX2TP7V7Y34M2WS Accept-Ranges bytes Alt-Svc h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" Content-Length 9148 Date Sun, 29 Sep 2024 23:06:48 GMT Last-Modified Wed, 22 Jul 2020 11:24:36 GMT Vary Accept-Encoding Server AmazonS3 Content-Type text/javascript x-amz-id-2 iIEBV8CrLOH1JeqDU7pATq0bkTyA8Oz0tcyrz2Y5MPx6uSPQCP24AYsqc7NecHviw8/9lC3pWoE=
GET H2	200	css fonts.googleapis.com/	717 B 888 B	604ms 49ms	Stylesheet text/css	216.58.206.42 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Lato&subset=latin-ext Requested by Host: cdn-bimi.akamaized.net URL: https://cdn-bimi.akamaized.net/landings/188578/1595417073/css/main.css?1595417073 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.206.42 , United States, ASN15169 (GOOGLE, US), Reverse DNS mil07s07-in-f10.1e100.net Software ESF / Resource Hash 77d9907ca853ab885fd7a35a29faaf4206b8fe47347cd9c12391d64451ad6f37 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://cdn-bimi.akamaized.net/ Response headers content-encoding gzip x-content-type-options nosniff expires Sun, 29 Sep 2024 23:06:49 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Sun, 29 Sep 2024 23:06:49 GMT content-type text/css; charset=utf-8 last-modified Sun, 29 Sep 2024 23:06:49 GMT x-frame-options SAMEORIGIN strict-transport-security max-age=31536000 link <https://fonts.gstatic.com>; rel=preconnect; crossorigin cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * cross-origin-opener-policy same-origin-allow-popups cross-origin-resource-policy cross-origin content-security-policy-report-only require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/bcfae741e379a885f2ab2cf83ebe6d32/mr access-control-allow-origin * x-xss-protection 0 server ESF
GET H2	200	gtm.js Show response www.googletagmanager.com/	190 KB 69 KB	538ms 65ms	Script application/javascript	216.58.206.72 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-PPJGZHL Requested by Host: xtermore.com URL: https://xtermore.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.206.72 , United States, ASN15169 (GOOGLE, US), Reverse DNS lhr35s11-in-f8.1e100.net Software Google Tag Manager / Resource Hash 1ec4dfe395d7a5bab30db2494729f47903d95934168b5d06f7f6cdebb1ba011f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://xtermore.com/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],} expires Sun, 29 Sep 2024 23:06:49 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Sun, 29 Sep 2024 23:06:49 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding last-modified Sun, 29 Sep 2024 21:00:00 GMT access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 69971 x-xss-protection 0 server Google Tag Manager
GET H/1.1	200 OK	no.png cdn-bimi.akamaized.net/landings/188578/1595417073/images/	3 KB 3 KB	57ms 56ms	Image image/png	23.207.210.96 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://cdn-bimi.akamaized.net/landings/188578/1595417073/images/no.png Requested by Host: cdn-bimi.akamaized.net URL: https://cdn-bimi.akamaized.net/landings/188578/1595417073/css/main.css?1595417073 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 23.207.210.96 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-207-210-96.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash fedd7527d1cceee3052bf4bb62e76d56e8200a115d8a2affae23a125578b7ad1 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://cdn-bimi.akamaized.net/landings/188578/1595417073/css/main.css?1595417073 Response headers ETag "e51438397f6333f22081857d4236efca" Connection keep-alive x-amz-request-id 99HN646JHXQ7PYD0 Accept-Ranges bytes Alt-Svc h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" Content-Length 3134 Date Sun, 29 Sep 2024 23:06:49 GMT Last-Modified Wed, 22 Jul 2020 11:24:36 GMT Content-Type image/png Server AmazonS3 x-amz-id-2 dzcutjml75nEldTqKVrsprMmdvNZarPKE6BDvIbvzTPdWNfMvsqDpqo+zSv2WNnOx5YL3UYcD9M=
GET H/1.1	200 OK	yes.png cdn-bimi.akamaized.net/landings/188578/1595417073/images/	3 KB 4 KB	40ms 39ms	Image image/png	23.207.210.96 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://cdn-bimi.akamaized.net/landings/188578/1595417073/images/yes.png Requested by Host: cdn-bimi.akamaized.net URL: https://cdn-bimi.akamaized.net/landings/188578/1595417073/css/main.css?1595417073 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 23.207.210.96 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-207-210-96.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 6bfdecff876226c1e233f71e7b0b1a6e0eb238281a52156c39f051691dd88a43 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://cdn-bimi.akamaized.net/landings/188578/1595417073/css/main.css?1595417073 Response headers ETag "3d0dab8337c085af1541ee5b7d63b53b" Connection keep-alive x-amz-request-id 99HMZ3P8E5SD6QJR Accept-Ranges bytes Alt-Svc h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" Content-Length 3480 Date Sun, 29 Sep 2024 23:06:49 GMT Last-Modified Wed, 22 Jul 2020 11:24:36 GMT Content-Type image/png Server AmazonS3 x-amz-id-2 QdMFvD3nHMOVwszvPhQwo68a/F2wy6PSuUFt74mPv5DQ5NnWwtCD1X8wo5nXl9qTEuclwIXtkHY=
GET H/1.1	200 OK	1.jpg cdn-bimi.akamaized.net/landings/188578/1595417073/images/	295 KB 295 KB	50ms 50ms	Image image/jpeg	23.207.210.96 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://cdn-bimi.akamaized.net/landings/188578/1595417073/images/1.jpg Requested by Host: cdn-bimi.akamaized.net URL: https://cdn-bimi.akamaized.net/landings/188578/1595417073/css/main.css?1595417073 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 23.207.210.96 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-207-210-96.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 4b7f1fe15626316cde2a1de45abe6ec03522d836c718f658e2cbfbb39dd96aaa Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://cdn-bimi.akamaized.net/landings/188578/1595417073/css/main.css?1595417073 Response headers ETag "067cfcdae9359e7eca833f7a92f870b1" Connection keep-alive x-amz-request-id 99HRT8FDS447S52K Accept-Ranges bytes Alt-Svc h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" Content-Length 302136 Date Sun, 29 Sep 2024 23:06:49 GMT Last-Modified Wed, 22 Jul 2020 11:24:35 GMT Content-Type image/jpeg Server AmazonS3 x-amz-id-2 TkZSFOZGAUiGwTQ0qCZPODsLHqU6630A/Ig4JKk+uDhvBWwVKrbxMf6JTSylJzBe4JNOXjnCJas=
GET H/1.1	200 OK	pattern.png cdn-bimi.akamaized.net/landings/188578/1595417073/images/	3 KB 3 KB	42ms 42ms	Image image/png	23.207.210.96 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://cdn-bimi.akamaized.net/landings/188578/1595417073/images/pattern.png Requested by Host: cdn-bimi.akamaized.net URL: https://cdn-bimi.akamaized.net/landings/188578/1595417073/css/main.css?1595417073 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 23.207.210.96 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-207-210-96.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 5cbc28ef1cf07ab8956014b581aa2b96baac861237975813702e63c886b0c004 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://cdn-bimi.akamaized.net/landings/188578/1595417073/css/main.css?1595417073 Response headers ETag "f06b5903c3ed5ef39db9b98b60deba70" Connection keep-alive x-amz-request-id 99HRVQHJEABEXX8H Accept-Ranges bytes Alt-Svc h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" Content-Length 2801 Date Sun, 29 Sep 2024 23:06:49 GMT Last-Modified Wed, 22 Jul 2020 11:24:36 GMT Content-Type image/png Server AmazonS3 x-amz-id-2 TRSvJAGtOtK8PtpOLODvIW6Z4+aSiPZuLfuxike2reInw1A4tbqRRnoWsJTK4HzFZuSQRQffh/CT/xtgCwZtl7ebad7CXcQceSMnodzk9h8=
GET H2	200	S6uyw4BMUTPHjx4wXg.woff2 fonts.gstatic.com/s/lato/v24/	23 KB 24 KB	451ms 33ms	Font font/woff2	142.250.185.99 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Lato&subset=latin-ext Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.99 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s49-in-f3.1e100.net Software sffe / Resource Hash 918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://xtermore.com Referer https://fonts.googleapis.com/ Response headers age 292323 report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} x-content-type-options nosniff expires Fri, 26 Sep 2025 13:54:46 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Thu, 26 Sep 2024 13:54:46 GMT last-modified Tue, 02 May 2023 15:17:22 GMT content-type font/woff2 cache-control public, max-age=31536000 timing-allow-origin * cross-origin-opener-policy same-origin; report-to="apps-themes" cross-origin-resource-policy cross-origin content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes accept-ranges bytes access-control-allow-origin * content-length 23580 x-xss-protection 0 server sffe
GET H2	200	subscriber.js Show response rkkmj.findiover.com/js/pushjs/1.0.0/	14 KB 4 KB	432ms 84ms	Script application/javascript	52.19.101.114 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://rkkmj.findiover.com/js/pushjs/1.0.0/subscriber.js Requested by Host: xtermore.com URL: https://xtermore.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.19.101.114 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-19-101-114.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash 197fbcbda196254842164e91f2f0873c08a569189262d335f82d05235f33cd23 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://xtermore.com/ Response headers expires Sun, 06 Oct 2024 23:06:49 GMT cache-control max-age=604800 content-encoding gzip date Sun, 29 Sep 2024 23:06:49 GMT content-type application/javascript server nginx
GET H2	200	firebase-app.min.js Show response cdnjs.cloudflare.com/ajax/libs/firebase/8.2.2/	19 KB 6 KB	844ms 424ms	Script application/javascript	104.17.25.14 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/firebase/8.2.2/firebase-app.min.js Requested by Host: rkkmj.findiover.com URL: https://rkkmj.findiover.com/js/pushjs/1.0.0/subscriber.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 00d770fea1249b4be3f55a037a9edd20c1fe55bda8ab1e4b6251e56cd74cd05b Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://xtermore.com/ Response headers cf-cdnjs-via cfworker/kv content-encoding br cf-cache-status HIT etag "5ff7ae08-4d44" age 955371 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NMhHlJ2tRN%2FoXFsybhHrxVwBh1rMjKpRyIddhTB6MM%2Bbv5zvP%2BoxTbTznIbJqHicKNG28nea0hRgc42iMlwmEw9mec9SXFdJEpWjWiD4x5UucaE7O%2B6Cveq5ekmXSM6YSx7pp9IM"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff expires Fri, 19 Sep 2025 23:06:49 GMT date Sun, 29 Sep 2024 23:06:49 GMT content-type application/javascript; charset=utf-8 last-modified Fri, 08 Jan 2021 00:57:44 GMT vary Accept-Encoding strict-transport-security max-age=15780000 cache-control public, max-age=30672000 timing-allow-origin * nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} cross-origin-resource-policy cross-origin cf-ray 8cafa03e1aa84c49-MXP accept-ranges bytes access-control-allow-origin * content-length 5762 server cloudflare
GET H2	200	firebase-messaging.js Show response www.gstatic.com/firebasejs/8.2.2/	40 KB 11 KB	842ms 423ms	Script text/javascript	142.250.186.131 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/firebasejs/8.2.2/firebase-messaging.js Requested by Host: rkkmj.findiover.com URL: https://rkkmj.findiover.com/js/pushjs/1.0.0/subscriber.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.131 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f3.1e100.net Software sffe / Resource Hash 8e494f1321a6b31f3f2c5b67d5ed2242260adae69ac403bf87daba0aa6f0d9cf Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://xtermore.com/ Response headers content-encoding gzip age 318936 report-to {"group":"firebase-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/firebase-js"}]} x-content-type-options nosniff expires Fri, 26 Sep 2025 06:31:13 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Thu, 26 Sep 2024 06:31:13 GMT last-modified Thu, 07 Jan 2021 21:51:17 GMT content-type text/javascript; charset=UTF-8 vary Accept-Encoding cache-control public, max-age=31536000 cross-origin-opener-policy same-origin-allow-popups; report-to="firebase-js" cross-origin-resource-policy cross-origin content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/firebase-js accept-ranges bytes access-control-allow-origin * content-length 10840 x-xss-protection 0 server sffe
GET H2	404	utils.js xtermore.com/js/pushjs/1.0.0/	0 0	390ms 388ms	Script text/html	172.67.179.14 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://xtermore.com/js/pushjs/1.0.0/utils.js Requested by Host: rkkmj.findiover.com URL: https://rkkmj.findiover.com/js/pushjs/1.0.0/subscriber.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.179.14 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://xtermore.com/ Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br cf-cache-status MISS speculation-rules "/cdn-cgi/speculation" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FCF3a1BDYeFjZHSjxbG75oAN5xzrH3BzF4vbYlMNhdYmWJx9W8JqYmHypV9%2B2LyajNnP7v0kUHA%2Fd58yEcRwbbQizxEMGtXhObT8CD5ebQhJbN0nK0TkPsbwcxKClBc%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8cafa03b6acebacf-MXP date Sun, 29 Sep 2024 23:06:49 GMT content-type text/html vary Accept-Encoding server cloudflare
GET H2	200	a29e4033-f1e9-4244-ad9b-e100f20a3cc4 tsyndicate.com/api/v1/retargeting/set/	43 B 436 B	635ms 443ms	Image image/gif	136.243.75.209 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://tsyndicate.com/api/v1/retargeting/set/a29e4033-f1e9-4244-ad9b-e100f20a3cc4 Requested by Host: xtermore.com URL: https://xtermore.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 136.243.75.209 Cologne, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.209.75.243.136.clients.your-server.de Software nginx / Resource Hash 42cb846e07917f6731406e500f24aeb2e88c42cda124eaa59e08c5331cad8bcb Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://xtermore.com/ Response headers x-robots-tag none, noindex, nofollow cache-control no-cache, no-store, no-transform, must-revalidate, no-transform pragma no-cache x-api-version 1 report-to { "url": "https://pxl.tsyndicate.com/api/v1/heavy-ad/report", "max_age": 86401 } expires 0 content-length 43 date Sun, 29 Sep 2024 23:06:49 GMT content-type image/gif vary * server nginx
GET H2	200	ctrack ctrack.trafficjunky.net/	43 B 592 B	634ms 453ms	Image image/gif	66.254.114.154 REFLECTED
General Check archive.org Show headers Download Go to Show image Full URL https://ctrack.trafficjunky.net/ctrack?action=list&type=add&id=1&context=im&cookiename=start&age=545600&maxcookiecount=10 Requested by Host: xtermore.com URL: https://xtermore.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 66.254.114.154 , United States, ASN29789 (REFLECTED, US), Reverse DNS reflectededge.reflected.net Software openresty / Resource Hash b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://xtermore.com/ Response headers access-control-max-age 86400 cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 pragma no-cache accept-ch Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version access-control-allow-credentials true access-control-allow-methods GET,POST expires Sun, 22 Jan 1984 03:00:00 GMT access-control-allow-origin * content-length 43 p3p CP="IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA" date Sun, 29 Sep 2024 23:06:49 GMT content-type image/gif server openresty access-control-allow-headers Content-Type
GET H/1.1	200 OK	favicon.ico cdn-bimi.akamaized.net/images/	4 KB 4 KB	41ms 40ms	Other image/x-icon	23.207.210.96 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://cdn-bimi.akamaized.net/images/favicon.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 23.207.210.96 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-207-210-96.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash fbfff44a653dc193b93620f1035d221d3aaddf3238742270b3385482986ef7f0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://xtermore.com/ Response headers ETag "4cdf3256cd7b8ec3917adb79d6bf457e" Connection keep-alive x-amz-request-id JMVFXE64ZJAH5BCS Accept-Ranges bytes Alt-Svc h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" Content-Length 4103 Date Sun, 29 Sep 2024 23:06:50 GMT Last-Modified Wed, 07 Nov 2018 08:41:38 GMT Content-Type image/x-icon Server AmazonS3 x-amz-id-2 ZU6vJlkIk+bqKqCRuj/xcflpyeHqJNWAc2QsRgRtnIxpWrWQ7wWbG5oq4/dqm/hXMq0sjTDEpKk=

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Porn Scam (Online)

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| _push function| sclk function| repplace function| imosbn function| rtbCall object| _rup function| $ function| jQuery object| langs object| dataLayer object| _pcq string| partyId string| uiServerUrl string| apiServerUrl string| swScope string| customWorkerJS object| pushConfig object| messaging object| indexedDBConfig object| indexedDBFCMConfig object| pushLoopDomains object| messageBody function| logger function| loadScriptAsync object| scriptLoaded function| defaultIfEmpty function| notBlank object| google_tag_manager object| google_tag_data object| firebase

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			tsyndicate.com/	1970-01-21 08:39:47	Name: ts_rt_a29e4033-f1e9-4244-ad9b-e100f20a3cc4 Value: AAMC

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://xtermore.com/(Line 107) Message: The value "false" for key "user-scalable" is invalid, and has been ignored.
network	error	URL: https://xtermore.com/js/pushjs/1.0.0/utils.js Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn-bimi.akamaized.net
cdnjs.cloudflare.com
ctrack.trafficjunky.net
fonts.googleapis.com
fonts.gstatic.com
rkkmj.findiover.com
tsyndicate.com
www.googletagmanager.com
www.gstatic.com
xtermore.com
104.17.25.14
136.243.75.209
142.250.185.99
142.250.186.131
172.67.179.14
216.58.206.42
216.58.206.72
23.207.210.96
52.19.101.114
66.254.114.154
00d770fea1249b4be3f55a037a9edd20c1fe55bda8ab1e4b6251e56cd74cd05b
0aa575ab7a50d63721a0bdc438eb3b4e627e372256c9e7007ae2523f02d191e3
11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d
197fbcbda196254842164e91f2f0873c08a569189262d335f82d05235f33cd23
1ec4dfe395d7a5bab30db2494729f47903d95934168b5d06f7f6cdebb1ba011f
322d600431f53fb186989dad7e4ed1365b0d3012a808cd114390855a0dce16a6
42cb846e07917f6731406e500f24aeb2e88c42cda124eaa59e08c5331cad8bcb
492d8e4c856f589d7395a8c61f152e3840e21dbad322602008c173ee2180765c
4b7f1fe15626316cde2a1de45abe6ec03522d836c718f658e2cbfbb39dd96aaa
5cbc28ef1cf07ab8956014b581aa2b96baac861237975813702e63c886b0c004
6bfdecff876226c1e233f71e7b0b1a6e0eb238281a52156c39f051691dd88a43
77d9907ca853ab885fd7a35a29faaf4206b8fe47347cd9c12391d64451ad6f37
8e494f1321a6b31f3f2c5b67d5ed2242260adae69ac403bf87daba0aa6f0d9cf
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
948964f18da76a83569929e01bbb08c6108a24daa2eb8ea93575f80eb31573a3
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
c4e62e899d387cd5be4770f35d30a90a4a0b7690e5a70fe510d61192a55df2fb
fbfff44a653dc193b93620f1035d221d3aaddf3238742270b3385482986ef7f0
fedd7527d1cceee3052bf4bb62e76d56e8200a115d8a2affae23a125578b7ad1