schlitzauge.xyz - urlscan.io

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 4 HTTP transactions. The main IP is 2606:4700:3035::ac43:de09, located in United States and belongs to CLOUDFLARENET, US. The main domain is schlitzauge.xyz.
TLS certificate: Issued by GTS CA 1P5 on July 8th 2023. Valid for: 3 months.

This is the only time schlitzauge.xyz was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	5.159.227.193 5.159.227.193	20860 (IOMART-AS) (IOMART-AS)
1 4	2606:4700:303... 2606:4700:3035::ac43:de09	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2

1 5.159.227.193 (United Kingdom)

ASN20860 (IOMART-AS, GB)
PTR: source23-vm1.vm.melbourne.co.uk

source23.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:3035::ac43:de09 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

schlitzauge.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	schlitzauge.xyz 1 redirects schlitzauge.xyz	6 KB
1	source23.com source23.com	252 B
4	2

	Domain	Requested by
4	schlitzauge.xyz	1 redirects schlitzauge.xyz
1	source23.com
4	2

This site contains no links.

Subject Issuer	Validity	Valid
schlitzauge.xyz GTS CA 1P5	`2023-07-08` - `2023-10-06`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://schlitzauge.xyz/bunker
Frame ID: A31D008BE231D987A05426D76B51AF1C
Requests: 2 HTTP requests in this frame

Frame: https://schlitzauge.xyz/cdn-cgi/challenge-platform/h/b/scripts/jsd/556d0c9f/invisible.js
Frame ID: 55E3564B7CCBE57B01F7F61E4BDA4515
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

404 Not Found

Page URL History Show full URLs

http://source23.com/images/wp-content/plugins/better-wp-security/modules/free/away-mode/css/smoo... Page URL
https://schlitzauge.xyz/bunker Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Page Statistics

4
Requests

50 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

6 kB
Transfer

8 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://source23.com/images/wp-content/plugins/better-wp-security/modules/free/away-mode/css/smoothness/images/basilix3.php?r=bD1odHRwczovL3NjaGxpdHphdWdlLnh5ei9idW5rZXI= Page URL
https://schlitzauge.xyz/bunker Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

https://schlitzauge.xyz/cdn-cgi/challenge-platform/scripts/invisible.js HTTP 302
https://schlitzauge.xyz/cdn-cgi/challenge-platform/h/b/scripts/jsd/556d0c9f/invisible.js

4 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK basilix3.php Show response
source23.com/images/wp-content/plugins/better-wp-security/modules/free/away-mode/css/smoothness/images/ 75 B
252 B 81ms
32ms Document
text/html 5.159.227.193
IOMART-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://source23.com/images/wp-content/plugins/better-wp-security/modules/free/away-mode/css/smoothness/images/basilix3.php?r=bD1odHRwczovL3NjaGxpdHphdWdlLnh5ei9idW5rZXI=
Protocol: HTTP/1.1
Server: 5.159.227.193 , United Kingdom, ASN20860 (IOMART-AS, GB),
Reverse DNS: source23-vm1.vm.melbourne.co.uk
Software: Microsoft-IIS/7.5 / PHP/5.4.24 ASP.NET
Resource Hash: d60da11a3a65bd5c5fbe1668a17af14920d5c44127bc1def31ab87981fcb3cb1

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

Content-Length: 75
Content-Type: text/html
Date: Thu, 13 Jul 2023 06:11:15 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: PHP/5.4.24 ASP.NET

GET
H2 404 Primary Request bunker Show response
schlitzauge.xyz/ 1 KB
1 KB 230ms
147ms Document
text/html 2606:4700:3035::ac43:de09
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://schlitzauge.xyz/bunker
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::ac43:de09 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 33f7c74e820fa908cb640c52aa111a32c9dee3f42fb20d64b65a6b9be455e3e4

Request headers

Referer: http://source23.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7e5fbc00bd97752d-LHR
content-encoding: br
content-type: text/html; charset=UTF-8
date: Thu, 13 Jul 2023 07:15:22 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rnpMebjRiPv0PTOgRa2x4MjpOVPHDxbrYSoVbgGOH0%2FfKmL9aAgd06bq9%2BhBBFYMLOgMUgxiBS2cAdIOFZ%2BepEhJ2nsQEQzViIcGZf6itR9umfXpYu00rRFDarlS3Y0MiHSKokmL%2FoBR6hVLHbk%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H2

200

invisible.js Show response
schlitzauge.xyz/cdn-cgi/challenge-platform/h/b/scripts/jsd/556d0c9f/ Frame 55E3
Redirect Chain

https://schlitzauge.xyz/cdn-cgi/challenge-platform/scripts/invisible.js
https://schlitzauge.xyz/cdn-cgi/challenge-platform/h/b/scripts/jsd/556d0c9f/invisible.js

7 KB
4 KB

35ms
34ms

Script
application/javascript

2606:4700:3035::ac43:de09
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://schlitzauge.xyz/cdn-cgi/challenge-platform/h/b/scripts/jsd/556d0c9f/invisible.js

Protocol

H2

Server

2606:4700:3035::ac43:de09 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ba66841d83105b8d26642c5e9b41b695796a9e5c29eafafc5fdd1a5579a62c07

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 13 Jul 2023 07:15:22 GMT
content-encoding: br
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E%2Bx5PYgbduDewUfBQHWa0HXc2cT%2Bfr7BuZrPNu7vHvneGv2xOmfh0MO2unNDe82TXKMO%2Fvq8PEVStpkPpWrhwu472V7Dy%2Be7bAI%2FtoN2EzrVs0Xfyk8PWilXNOzYdqi5fobmPBNfYhvp31zYs7U%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
cf-ray: 7e5fbc021f0c752d-LHR
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Thu, 13 Jul 2023 07:15:22 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EJl7aeZCKuh0N%2FwuzkH1o5inj%2Bsx9is2V3%2FjVGup%2BdyrxidF5d9jOge05UaZGUa2SPLFi42E4F1fz%2Bth7OTAtY28nq5c731Bcj%2B963QhmyqvV4Jg0VVDdl6Th3LcuYyNGW1bTQFobywzMSDVz1A%3D"}],"group":"cf-nel","max_age":604800}
location: /cdn-cgi/challenge-platform/h/b/scripts/jsd/556d0c9f/invisible.js
access-control-allow-origin: *
cache-control: max-age=300, public
cf-ray: 7e5fbc01deee752d-LHR
alt-svc: h3=":443"; ma=86400

POST
H3 200 7e5fbc00bd97752d Show response
schlitzauge.xyz/cdn-cgi/challenge-platform/h/b/cv/result/ Frame 55E3 0
616 B 64ms
62ms XHR
text/plain 2606:4700:3035::ac43:de09
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://schlitzauge.xyz/cdn-cgi/challenge-platform/h/b/cv/result/7e5fbc00bd97752d
Requested by: Host: schlitzauge.xyz
URL: https://schlitzauge.xyz/cdn-cgi/challenge-platform/scripts/invisible.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:de09 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 13 Jul 2023 07:15:22 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E5s8oMmYJ9IyYmcyuuOtGp3ZGdk62U06D5t4c6B%2F6VCTDeIDo9I%2FhxBhMa9WxF9atG4ATniZ%2BdA8Iip8KZVahLQgpjJUFfCsdeEe23PmqzO9qK6Vrwt8yQZIvGftEiiQlWld4nQcluyZQvxM8Oo%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=UTF-8
cf-ray: 7e5fbc033ff088c2-LHR
alt-svc: h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 boolean| credentialless object| onbeforetoggle object| onscrollend

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.schlitzauge.xyz/	1970-01-20 13:13:54	Name: __cf_bm Value: 6qAbEXRw2Vd77StP1QO0iWxbponY3VC523dYPg7kbJA-1689232522-0-AabTQ23Ez0FESdq3pSbTbQ+vMZnxi8ipFMqCz3vzfH4d+BJSU1ZDENF8MxDT0XmD2A==

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://schlitzauge.xyz/bunker Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

schlitzauge.xyz
source23.com
2606:4700:3035::ac43:de09
5.159.227.193
33f7c74e820fa908cb640c52aa111a32c9dee3f42fb20d64b65a6b9be455e3e4
ba66841d83105b8d26642c5e9b41b695796a9e5c29eafafc5fdd1a5579a62c07
d60da11a3a65bd5c5fbe1668a17af14920d5c44127bc1def31ab87981fcb3cb1
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

schlitzauge.xyz Open in urlscan Pro 2606:4700:3035::ac43:de09 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

4 Requests

50 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

6 kBTransfer

8 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

schlitzauge.xyz Open in urlscan Pro
2606:4700:3035::ac43:de09 Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

50 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

6 kB
Transfer

8 kB
Size

1
Cookies

4 HTTP transactions
0 data transactions