portal-descuentosclaro.usite.pro Open in urlscan Pro
213.174.157.153 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://portal-descuentosclaro.usite.pro/index.html?sid=Z1o0akpsYmJ0M2hFWkExdHNmZVdHS3V0V25oMXQ1NXNkYUZiWERkS2RqRT0=
Submission Tags: @phish_report
Submission: On November 01 via api (November 1st 2024, 7:55:43 pm UTC) from FI — Scanned from FI

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 5 domains to perform 8 HTTP transactions. The main IP is 213.174.157.153, located in Ashburn, United States and belongs to ADVANCEDHOSTERS-AS, NL. The main domain is portal-descuentosclaro.usite.pro.
TLS certificate: Issued by GoGetSSL RSA DV CA on February 15th 2024. Valid for: a year.

This is the only time portal-descuentosclaro.usite.pro was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	213.174.157.153 213.174.157.153	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
1	104.17.24.14 104.17.24.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	82.112.249.98 82.112.249.98	47583 (AS-HOSTINGER) (AS-HOSTINGER)
1	172.67.70.233 172.67.70.233	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	5

2 213.174.157.153 (Ashburn, United States)

ASN39572 (ADVANCEDHOSTERS-AS, NL)

portal-descuentosclaro.usite.pro	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.24.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 82.112.249.98 (United Kingdom)

ASN47583 (AS-HOSTINGER, CY)

k3k.us.to	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.70.233 (United States)

ASN13335 (CLOUDFLARENET, US)

get.geojs.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	us.to k3k.us.to	11 KB
2	usite.pro portal-descuentosclaro.usite.pro	16 KB
1	geojs.io get.geojs.io — Cisco Umbrella Rank: 18160	697 B
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 220	25 KB
0	google.com Failed www.google.com Failed
8	5

	Domain	Requested by
3	k3k.us.to	portal-descuentosclaro.usite.pro
2	portal-descuentosclaro.usite.pro
1	get.geojs.io	k3k.us.to
1	cdnjs.cloudflare.com	portal-descuentosclaro.usite.pro
0	www.google.com Failed	k3k.us.to
8	5

This site contains no links.

Subject Issuer	Validity	Valid
*.usite.pro GoGetSSL RSA DV CA	`2024-02-15` - `2025-03-16`	a year	crt.sh
cdnjs.cloudflare.com WE1	`2024-09-28` - `2024-12-27`	3 months	crt.sh
k3k.us.to R10	`2024-10-16` - `2025-01-14`	3 months	crt.sh
geojs.io WE1	`2024-09-04` - `2024-12-03`	3 months	crt.sh

This page contains 1 frames:

Frame: https://www.google.com/
Frame ID: 9734B1967DA4BB433B3FF008BF22F98A
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

8
Requests

88 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

52 kB
Transfer

278 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 6

https://google.com/ HTTP 301
https://www.google.com/

8 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request index.html Show response
portal-descuentosclaro.usite.pro/ 499 B
621 B 1048ms
217ms Document
text/html 213.174.157.153
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://portal-descuentosclaro.usite.pro/index.html?sid=Z1o0akpsYmJ0M2hFWkExdHNmZVdHS3V0V25oMXQ1NXNkYUZiWERkS2RqRT0=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

213.174.157.153 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),

Reverse DNS

Software

nginx /

Resource Hash

6a53d15e872e1e80fc47cd290ae5a104152ad3cf4d2e36660974736e10c26eb1

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

Cache-Control: max-age=1728000
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Fri, 01 Nov 2024 19:55:35 GMT
Expires: Thu, 21 Nov 2024 19:55:35 GMT
Keep-Alive: timeout=15
Server: nginx
Transfer-Encoding: chunked
X-Frame-Options: SAMEORIGIN

GET
H2 200 crypto-js.js Show response
cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.9-1/ 187 KB
25 KB 739ms
197ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.9-1/crypto-js.js

Requested by

Host: portal-descuentosclaro.usite.pro
URL: https://portal-descuentosclaro.usite.pro/index.html?sid=Z1o0akpsYmJ0M2hFWkExdHNmZVdHS3V0V25oMXQ1NXNkYUZiWERkS2RqRT0=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c6826494432163d74fd27e78ad011a13d55e4670441cd49fc9f1e52a4afd28d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://portal-descuentosclaro.usite.pro/

Response headers

cf-cdnjs-via: cfworker/kv
content-encoding: br
cf-cache-status: HIT
etag: "5eb03e2d-2edc0"
age: 183613
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mYc2FwZQa1GiJbieLiQjtKT0%2Fej3fn3WpY%2FA5g6drNAW4Zi9JzWEfL9s7Nuco%2FHHWCu2y5Fnq3aXvdD%2F%2FRhy0CaR2NdqP5noy6hCYxwqzR8pnnvRo4MH39euwYTaGjmD4L9r3WtK"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Wed, 22 Oct 2025 19:55:37 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 01 Nov 2024 19:55:37 GMT
content-type: application/javascript; charset=utf-8
last-modified: Mon, 04 May 2020 16:09:17 GMT
vary: Accept-Encoding
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 8dbe71850b7d8d7b-HEL
accept-ranges: bytes
access-control-allow-origin: *
content-length: 24518
server: cloudflare

GET
H2 200 scripts.js Show response
k3k.us.to/srv/ 3 KB
1 KB 1241ms
418ms Script
application/x-javascript 82.112.249.98
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://k3k.us.to/srv/scripts.js

Requested by

Host: portal-descuentosclaro.usite.pro
URL: https://portal-descuentosclaro.usite.pro/index.html?sid=Z1o0akpsYmJ0M2hFWkExdHNmZVdHS3V0V25oMXQ1NXNkYUZiWERkS2RqRT0=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

82.112.249.98 , United Kingdom, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

460c1fb9da69709c8f951bea4bf5e0387932b48f62b05b3aec26e8762dd7a572

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Origin: https://portal-descuentosclaro.usite.pro
Referer: https://portal-descuentosclaro.usite.pro/

Response headers

content-encoding: br
etag: "b97-66c8947b-1f001722af9bc04c;br"
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
expires: Fri, 08 Nov 2024 19:55:37 GMT
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
date: Fri, 01 Nov 2024 19:55:37 GMT
content-type: application/x-javascript
last-modified: Fri, 23 Aug 2024 13:54:03 GMT
vary: Accept-Encoding
platform: hostinger
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
content-security-policy: upgrade-insecure-requests
cache-control: public, max-age=604800
accept-ranges: bytes
access-control-allow-origin: *
content-length: 763
server: LiteSpeed
panel: hpanel

GET
H2 200 tools.js Show response
k3k.us.to/srv/ 6 KB
3 KB 449ms
448ms Script
application/x-javascript 82.112.249.98
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://k3k.us.to/srv/tools.js

Requested by

Host: portal-descuentosclaro.usite.pro
URL: https://portal-descuentosclaro.usite.pro/index.html?sid=Z1o0akpsYmJ0M2hFWkExdHNmZVdHS3V0V25oMXQ1NXNkYUZiWERkS2RqRT0=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

82.112.249.98 , United Kingdom, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

4c8ded4eb197e7e4c7e675ca5ecc8d52899cc8ed698e5e6273c0344914d38360

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Origin: https://portal-descuentosclaro.usite.pro
Referer: https://k3k.us.to/srv/scripts.js

Response headers

content-encoding: br
etag: "17ff-66c2159d-d9c91dff1f67d034;br"
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
expires: Fri, 08 Nov 2024 19:55:38 GMT
date: Fri, 01 Nov 2024 19:55:38 GMT
content-type: application/x-javascript
last-modified: Sun, 18 Aug 2024 15:39:09 GMT
vary: Accept-Encoding
platform: hostinger
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
content-security-policy: upgrade-insecure-requests
cache-control: public, max-age=604800
accept-ranges: bytes
access-control-allow-origin: *
content-length: 2575
server: LiteSpeed
panel: hpanel

GET
H2 200 handlers.js Show response
k3k.us.to/srv/ 66 KB
8 KB 448ms
448ms Script
application/x-javascript 82.112.249.98
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://k3k.us.to/srv/handlers.js

Requested by

Host: portal-descuentosclaro.usite.pro
URL: https://portal-descuentosclaro.usite.pro/index.html?sid=Z1o0akpsYmJ0M2hFWkExdHNmZVdHS3V0V25oMXQ1NXNkYUZiWERkS2RqRT0=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

82.112.249.98 , United Kingdom, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

7816d35377fbc0bda83489c3e3d8e7a4ba5f4ac171677998a4c7600172d13cc2

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Origin: https://portal-descuentosclaro.usite.pro
Referer: https://k3k.us.to/srv/scripts.js

Response headers

content-encoding: br
etag: "108af-66f6cd76-b0fa5e3c45c6eeba;br"
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
expires: Fri, 08 Nov 2024 19:55:38 GMT
date: Fri, 01 Nov 2024 19:55:38 GMT
content-type: application/x-javascript
last-modified: Fri, 27 Sep 2024 15:21:26 GMT
vary: Accept-Encoding
platform: hostinger
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
content-security-policy: upgrade-insecure-requests
cache-control: public, max-age=604800
accept-ranges: bytes
access-control-allow-origin: *
content-length: 7623
server: LiteSpeed
panel: hpanel

GET
H/1.1 200
OK favicon.ico
portal-descuentosclaro.usite.pro/ 15 KB
15 KB 359ms
358ms Other
image/x-icon 213.174.157.153
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://portal-descuentosclaro.usite.pro/favicon.ico

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

213.174.157.153 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),

Reverse DNS

Software

nginx /

Resource Hash

441ab4f4da564d1e43c1b117270dc5320dc993e6fb849479bfc82c8bcc60469b

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://portal-descuentosclaro.usite.pro/index.html?sid=Z1o0akpsYmJ0M2hFWkExdHNmZVdHS3V0V25oMXQ1NXNkYUZiWERkS2RqRT0=

Response headers

ETag: "6627a704-3aee"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 15086
Keep-Alive: timeout=15
Date: Fri, 01 Nov 2024 19:55:37 GMT
Content-Type: image/x-icon
Last-Modified: Tue, 23 Apr 2024 12:18:12 GMT
Server: nginx
X-Frame-Options: SAMEORIGIN

GET
H2 200 country.json Show response
get.geojs.io/v1/ip/ 72 B
697 B 1369ms
360ms Fetch
application/json 172.67.70.233
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://get.geojs.io/v1/ip/country.json

Requested by

Host: k3k.us.to
URL: https://k3k.us.to/srv/tools.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.70.233 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b088b3f1317c125821aa0623dd6354d27aadd601d5c8a00f64fd95e4e47704fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://portal-descuentosclaro.usite.pro/

Response headers

x-request-id: 98495392302ee471f3e63326c669980a-ASH
content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1JjSSDTKHLX0mmz8XUWEBVdS%2FUYPwvbXyg15gdwBAddEEiKPbEKnLyOOq3CK%2F72dXeWV2d1uZGCl5LIuYKHOjIZPDrRbRxdn2sKDW7SwipdXJmf1YaQ1yi4kI6U2Dg%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Fri, 01 Nov 2024 19:55:41 GMT
content-type: application/json
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 8dbe719eeef16301-HAM
access-control-allow-origin: *
geojs-backend: ash-01
server: cloudflare

GET

/
www.google.com/
Redirect Chain

https://google.com/
https://www.google.com/

0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.google.com
URL: https://www.google.com/

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| CryptoJS function| appendToInput function| removeFromInput

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
get.geojs.io
k3k.us.to
portal-descuentosclaro.usite.pro
www.google.com
www.google.com
104.17.24.14
172.67.70.233
213.174.157.153
82.112.249.98
441ab4f4da564d1e43c1b117270dc5320dc993e6fb849479bfc82c8bcc60469b
460c1fb9da69709c8f951bea4bf5e0387932b48f62b05b3aec26e8762dd7a572
4c8ded4eb197e7e4c7e675ca5ecc8d52899cc8ed698e5e6273c0344914d38360
6a53d15e872e1e80fc47cd290ae5a104152ad3cf4d2e36660974736e10c26eb1
7816d35377fbc0bda83489c3e3d8e7a4ba5f4ac171677998a4c7600172d13cc2
b088b3f1317c125821aa0623dd6354d27aadd601d5c8a00f64fd95e4e47704fa
c6826494432163d74fd27e78ad011a13d55e4670441cd49fc9f1e52a4afd28d9

portal-descuentosclaro.usite.pro Open in urlscan Pro 213.174.157.153 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

8 Requests

88 %HTTPS

0 %IPv6

5 Domains

5 Subdomains

5 IPs

3 Countries

52 kBTransfer

278 kBSize

0 Cookies

0 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

portal-descuentosclaro.usite.pro Open in urlscan Pro
213.174.157.153 Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

88 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

52 kB
Transfer

278 kB
Size

0
Cookies

8 HTTP transactions
0 data transactions