bem999.com Open in urlscan Pro
2606:4700:3033::6815:1c45 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://bem000.com/
Effective URL:
https://bem999.com/
Submission: On November 20 via manual (November 20th 2023, 6:03:37 am UTC) from IN — Scanned from NL

Summary HTTP 17 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 17 HTTP transactions. The main IP is 2606:4700:3033::6815:1c45, located in United States and belongs to CLOUDFLARENET, US. The main domain is bem999.com.
TLS certificate: Issued by GTS CA 1P5 on November 15th 2023. Valid for: 3 months.

This is the only time bem999.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Cloudflare (Online)

Domain & IP information

	IP Address	AS Autonomous System
2 6	2a06:98c1:312... 2a06:98c1:3121::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
13	2606:4700:303... 2606:4700:3033::6815:1c45	13335 (CLOUDFLAR...) (CLOUDFLARENET)
17	3

6 2a06:98c1:3121::3 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

bem000.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
config.oex2.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2606:4700:3033::6815:1c45 (United States)

ASN13335 (CLOUDFLARENET, US)

bem999.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pwa.bem999.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	bem999.com bem999.com pwa.bem999.com	1 MB
5	bem000.com 2 redirects bem000.com	9 KB
1	oex2.xyz config.oex2.xyz	695 B
17	3

	Domain	Requested by
11	bem999.com	bem999.com
5	bem000.com	2 redirects bem000.com
2	pwa.bem999.com	bem999.com
1	config.oex2.xyz	bem999.com
17	4

This site contains no links.

Subject Issuer	Validity	Valid
bem999.com GTS CA 1P5	`2023-11-15` - `2024-02-13`	3 months	crt.sh
config.oex2.xyz GTS CA 1P5	`2023-10-12` - `2024-01-10`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://bem999.com/
Frame ID: 63C609BEDA629405392CB3C45E05959F
Requests: 23 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

OEX

Page URL History Show full URLs

http://bem000.com/ Page URL
http://bem000.com/cdn-cgi/phish-bypass?atok=jiAUJpCWU6RIPglTb5Dt5hj8xznLFp0tIVs96_9EsKo-170046... HTTP 301
http://bem000.com/ HTTP 301
https://bem999.com/ Page URL

Detected technologies

Vue.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+\sdata-v(?:ue)?-

Page Statistics

17
Requests

82 %
HTTPS

100 %
IPv6

3
Domains

4
Subdomains

3
IPs

1
Countries

1279 kB
Transfer

2898 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://bem000.com/ Page URL
http://bem000.com/cdn-cgi/phish-bypass?atok=jiAUJpCWU6RIPglTb5Dt5hj8xznLFp0tIVs96_9EsKo-1700460206-0-%2F HTTP 301
http://bem000.com/ HTTP 301
https://bem999.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions
7 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK / Show response
bem000.com/ 4 KB
2 KB 83ms
35ms Document
text/html 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

http://bem000.com/

Protocol

HTTP/1.1

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

14efc517b8a4a8b2e50e5e0dd12bc120a716cee0a8471edb31218b8a5d53100a

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

CF-RAY: 828e7d600ae2b8f4-AMS
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Mon, 20 Nov 2023 06:03:26 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uXZggfXTaTXNbGztx9nc476DMMkDaUFu6z1%2Fva82qhMmG1V6%2BiGRIXJAb4T6ixkjsAxf4VyWEr8KxIqQpeiS9qJIV1PXNBW9t%2FHE8fYJdMlCemnq%2BKLcjNFEsQcpZhwb0rjXHUVkIYS9"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN

GET
H/1.1 200
OK cf.errors.css
bem000.com/cdn-cgi/styles/ 24 KB
5 KB 28ms
27ms Stylesheet
text/css 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

http://bem000.com/cdn-cgi/styles/cf.errors.css

Requested by

Host: bem000.com
URL: http://bem000.com/

Protocol

HTTP/1.1

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1103290e25ebda2712abe344a87facbac00ddaba712729be9fe5feef807bf91b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: http://bem000.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Mon, 20 Nov 2023 06:03:26 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Thu, 16 Nov 2023 21:55:48 GMT
Server: cloudflare
ETag: W/"65568fe4-5e44"
Transfer-Encoding: chunked
X-Frame-Options: DENY
Content-Type: text/css
Vary: Accept-Encoding
Cache-Control: max-age=7200, public
Connection: keep-alive
CF-RAY: 828e7d604b77b8f4-AMS
Expires: Mon, 20 Nov 2023 08:03:26 GMT

GET
H/1.1 200
OK icon-exclamation.png
bem000.com/cdn-cgi/images/ 452 B
889 B 27ms
27ms Image
image/png 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://bem000.com/cdn-cgi/images/icon-exclamation.png?1376755637

Requested by

Host: bem000.com
URL: http://bem000.com/cdn-cgi/styles/cf.errors.css

Protocol

HTTP/1.1

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: http://bem000.com/cdn-cgi/styles/cf.errors.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Mon, 20 Nov 2023 06:03:26 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 16 Nov 2023 21:55:48 GMT
Server: cloudflare
ETag: "65568fe4-1c4"
X-Frame-Options: DENY
Vary: Accept-Encoding
Content-Type: image/png
Cache-Control: max-age=7200, public
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 828e7d607bbbb8f4-AMS
Content-Length: 452
Expires: Mon, 20 Nov 2023 08:03:26 GMT

GET
H2

200

Primary Request / Show response
bem999.com/
Redirect Chain

http://bem000.com/cdn-cgi/phish-bypass?atok=jiAUJpCWU6RIPglTb5Dt5hj8xznLFp0tIVs96_9EsKo-1700460206-0-%2F
http://bem000.com/
https://bem999.com/

1 KB
842 B

504ms
442ms

Document
text/html

2606:4700:3033::6815:1c45
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bem999.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::6815:1c45 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5513f7a164c094e10a208e18ff0e55da32a2c476840ff05d739ee1ed7384a2cf

Request headers

Referer: http://bem000.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 828e7d7f9ffd1afc-AMS
content-encoding: br
content-type: text/html
date: Mon, 20 Nov 2023 06:03:31 GMT
last-modified: Sat, 26 Aug 2023 11:30:12 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NAHLSAzl%2FLq1ZQUMKUWHBcGpoigRLoRz74lu%2FWtofzxg1TtHjZ4BvqNWV8R1yGx10ECD7FW2RA1O6a0BoYsfU4Zstg7GG4NfaU9szvLm1gPFp5ufFZhT4VI7FU%2B0MOA711ZZ3CzGoPZF"}],"group":"cf-nel","max_age":604800}
server: cloudflare

Redirect headers

CF-Cache-Status: DYNAMIC
CF-RAY: 828e7d7c6aa4b8f4-AMS
Connection: keep-alive
Content-Type: text/html
Date: Mon, 20 Nov 2023 06:03:31 GMT
Location: https://bem999.com
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nXV%2B10o5g1DV0%2BdaWtjdkQ8Y3vi6rsLzw96eQPhTJTaleW3VqAvWp%2BctuOK07%2FTlh2OY9IRqQLUxVUtcYsQXsMVkiCiajzY%2BPNWdtdda4SHZYHi7oxaq32Bs5vyMuGHBkqhl%2FcckB5in"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
alt-svc: h3=":443"; ma=86400

GET
H2 200 app.a12972e3.css
bem999.com/static/css/ 71 KB
12 KB 245ms
243ms Stylesheet
text/css 2606:4700:3033::6815:1c45
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bem999.com/static/css/app.a12972e3.css
Requested by: Host: bem999.com
URL: https://bem999.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::6815:1c45 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a8db14b17cf8e75685f8bd8945a369ea0581cf03f46da4347acb9c44d82f2221

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://bem999.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 20 Nov 2023 06:03:31 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Sat, 26 Aug 2023 11:30:12 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"64e9e244-11a00"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sT%2FuwruJDqWWSl9KbWA%2BWjnvfLpuk92VS76meGRlqMsBKCGeszQRBblXolYUeoSHFIsi4VYWIcwqcOSqQZDiSQRIxBMtE05bb2SC0y59Rw3e8xCmw9rA%2BbHui1Ae15uN7TZi6zjZ3VB4"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 828e7d825a1d1afc-AMS
alt-svc: h3=":443"; ma=86400

GET
H2 200 chunk-vendors.6526ef48.css
bem999.com/static/css/ 140 KB
42 KB 442ms
441ms Stylesheet
text/css 2606:4700:3033::6815:1c45
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bem999.com/static/css/chunk-vendors.6526ef48.css
Requested by: Host: bem999.com
URL: https://bem999.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::6815:1c45 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 92f4715c1cd27be2d9862f150f75ec2bb17902c14cab2c2a761fb478a7fb56e2

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://bem999.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 20 Nov 2023 06:03:31 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Sat, 26 Aug 2023 11:30:12 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"64e9e244-22ef8"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7cAcbBkzVrYOg5yam5rBK55z0R0mSKI5BFL8WVOoxCEANaryF68RCSr2dVd9bKGdA7Xp79xDHA6LmDOg8goNH69ESd7%2FucXPYcbe6HX0ejk2uAlsLSxU11gpEK87mn40L9oVjz1XVwZZ"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 828e7d825a1e1afc-AMS
alt-svc: h3=":443"; ma=86400

GET
H2 200 app.7f89ed7c.js Show response
bem999.com/static/js/ 948 KB
263 KB 42ms
41ms Script
application/javascript 2606:4700:3033::6815:1c45
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bem999.com/static/js/app.7f89ed7c.js
Requested by: Host: bem999.com
URL: https://bem999.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::6815:1c45 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 93391d2f28d4c135aaf4d298e17070fc9a413a1ebfda1b9d7ba304bf849d88b1

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://bem999.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 20 Nov 2023 06:03:31 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sat, 26 Aug 2023 11:30:12 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 385
etag: W/"64e9e244-ecfeb"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aYIA09HI1No%2Fv05GcemLbhtFKkq%2Bz%2BzRby0l3HT1oeqX0sYAkpQXNSOBuBByNOSo%2Bi1%2Bz19G3K6mWTeJUazUjieTTBxkayVfaUgybubB8pYySYsou5ZxRCgA2Xw2GpCdTIVFVmDyjZw9"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 828e7d826a1f1afc-AMS
alt-svc: h3=":443"; ma=86400

GET
H2 200 chunk-vendors.f3031c62.js Show response
bem999.com/static/js/ 1 MB
342 KB 75ms
75ms Script
application/javascript 2606:4700:3033::6815:1c45
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bem999.com/static/js/chunk-vendors.f3031c62.js
Requested by: Host: bem999.com
URL: https://bem999.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::6815:1c45 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 33f21fef741fdc9facb01361aa254aa98c50e6d30753114a998f2874228f0386

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://bem999.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 20 Nov 2023 06:03:31 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sat, 26 Aug 2023 11:30:12 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 385
etag: W/"64e9e244-10f478"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3AfbSz4Uc1nbvZ9f7xlFskUL6biaZSYwIWsHOnNf%2FDU6XW6pyJmxvKzRGDJKNq36xzQyBpflZd9BhwQkZswV0kIcrd%2F69XNNmOllb%2BiS%2FSDNLxMBsTZjm9MvTbBQfa%2Bx0ARpi0pEKKpg"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 828e7d826a201afc-AMS
alt-svc: h3=":443"; ma=86400

GET
H2 200 env.js Show response
config.oex2.xyz/qex1/ 331 B
695 B 97ms
34ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://config.oex2.xyz/qex1/env.js

Requested by

Host: bem999.com
URL: https://bem999.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d7b00ea03713a00ecf98a84b6ee5ab9110aeca9a85263fcb670d254a5f30927d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://bem999.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 20 Nov 2023 06:03:31 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5717
alt-svc: h3=":443"; ma=86400
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"9ec0e45cd5dc2aa804f48ae3eea3ac12"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=p48eGMZXynZoTIKwOvAkpK7alUBBy7n2HcXQWCRHYKDsRMs6%2FUJXuMirOMO4XZZaQGPgmU6emPu9UeJowh4lfzzMfo%2B4iGdWOR1lSNi24ouVTIj%2FI2AXjVOmgSqFMG2efNw%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=14400, must-revalidate
cf-ray: 828e7d82c9226621-AMS

OPTIONS
H2 200 indexList
pwa.bem999.com/api/app/ 0
0 507ms
449ms Preflight
application/octet-stream 2606:4700:3033::6815:1c45
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pwa.bem999.com/api/app/indexList
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::6815:1c45 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: lang
Access-Control-Request-Method: GET
Origin: https://bem999.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 828e7d86ae450bea-AMS
content-length: 0
content-type: application/octet-stream
date: Mon, 20 Nov 2023 06:03:32 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5Opcp9bmeo8LOuR0bad7yaeKAjLZgDo%2BWq19i2qg8DwN4YZejmuywt0s9lRzH%2BQpTynWS1En6zWMY2Szh5ONfv7L9NYGb9Yp6jZDMvsl4U9vIltdEO3OSeRihugiOYo%2FU9RfMte62eQJgBOjPw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H3 200 topLine.png
bem999.com/static/img/ 62 KB
62 KB 474ms
473ms Image
image/png 2606:4700:3033::6815:1c45
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bem999.com/static/img/topLine.png
Requested by: Host: bem999.com
URL: https://bem999.com/static/css/app.a12972e3.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:1c45 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 858f4e3bd9961c7c32cdff87460ee8842a3d41a9ff976fa92a30733456bff7d7

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://bem999.com/static/css/app.a12972e3.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 20 Nov 2023 06:03:32 GMT
cf-cache-status: REVALIDATED
last-modified: Sat, 26 Aug 2023 11:30:12 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "64e9e244-f7fb"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7Ddd7VL1XrIRAdre17jpcF613unedP0basqCZN0nz7s7HKqa2mTcYLyApbmf3EdatheCYFzvLmbpOjVEvGCVLPscy%2Bd6w9eRulVCZgPhdRLDm8Rv4kTwQq%2Bfqnsd8Sc8EusQ4bbrE%2BxG"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 828e7d863936b939-AMS
alt-svc: h3=":443"; ma=86400
content-length: 63483

GET
H3 200 12312.png
bem999.com/static/img/ 147 KB
147 KB 446ms
445ms Image
image/png 2606:4700:3033::6815:1c45
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bem999.com/static/img/12312.png
Requested by: Host: bem999.com
URL: https://bem999.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:1c45 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bb8e6401ae9fefc44d283c945894315b23028bc2268e254217af97440ef2e92b

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://bem999.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 20 Nov 2023 06:03:32 GMT
cf-cache-status: REVALIDATED
last-modified: Sat, 26 Aug 2023 11:30:12 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "64e9e244-24a33"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L57D3HASdosMhfJ86%2BqP7F8PT5gRABJJ0fCosmlfp5m8I1EGywmx23wABRxeb93lg3DUv4HN5lJ7YS2xRkLi8p7nRsPyMliOSLJRdgZplUU27O283krw2rOW8FkieUJlj3CO8vMjkldQ"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 828e7d863938b939-AMS
alt-svc: h3=":443"; ma=86400
content-length: 150067

GET
DATA 200
OK truncated
/ 23 KB
23 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9c660f9252dfe12a6072fb38088fd444df33cc01094ccf547ce99b32b98e4b0a

Request headers

Referer
Origin: https://bem999.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: font/woff2;charset=utf-8

GET
H3 200 banner.png
bem999.com/static/img/ 273 KB
274 KB 543ms
542ms Image
image/png 2606:4700:3033::6815:1c45
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bem999.com/static/img/banner.png
Requested by: Host: bem999.com
URL: https://bem999.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:1c45 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7b583b987ab9038c6cbd734d86f27963588bdc3909643334191497a1b0541dc6

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://bem999.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 20 Nov 2023 06:03:32 GMT
cf-cache-status: REVALIDATED
last-modified: Sat, 26 Aug 2023 11:30:12 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "64e9e244-444d4"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hKW0j8Iuq2togh%2FfoziJmtV%2FqUlS8GDZ8W3%2FpMlj2WNuIGCxYbSAtyGkQQhkT1t%2FdIXWgBJnnv9fIZjdWR53be7ETx4Gf5LW4c4AuQTcKqHdIhzjKLF2A7dEcH6cii9w3FEoh5zEa2Fu"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 828e7d86493bb939-AMS
alt-svc: h3=":443"; ma=86400
content-length: 279764

GET
H3 200 invite_people.png
bem999.com/static/img/ 78 KB
78 KB 571ms
570ms Image
image/png 2606:4700:3033::6815:1c45
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bem999.com/static/img/invite_people.png
Requested by: Host: bem999.com
URL: https://bem999.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:1c45 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b32881c15b19510defea492e550ee4baf864b67d9eb6518e5350abfcdd338e55

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://bem999.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 20 Nov 2023 06:03:32 GMT
cf-cache-status: REVALIDATED
last-modified: Sat, 26 Aug 2023 11:30:12 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "64e9e244-13743"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JvCgd4%2BvrlHS3byGV5hV6w3H52jBaNwhqCBBmRFpH5S0Eao1vpANr%2FI5hdL2fpMna319DJFuLbusU7deiud%2FNSr7mIlD41N3DkUkIH4yZAXVKgdd6F4vXOFRcfiBbTbgSG2CgaehdwbH"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 828e7d86493cb939-AMS
alt-svc: h3=":443"; ma=86400
content-length: 79683

GET
H3 200 BTC.2cd97a13.png
bem999.com/static/img/ 21 KB
21 KB 572ms
571ms Image
image/png 2606:4700:3033::6815:1c45
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bem999.com/static/img/BTC.2cd97a13.png
Requested by: Host: bem999.com
URL: https://bem999.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:1c45 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a6efbd988540bf6b1658f34a15776fdf95b2d73b0b2393aa0798ff83994cf7fe

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://bem999.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 20 Nov 2023 06:03:32 GMT
cf-cache-status: REVALIDATED
last-modified: Sat, 26 Aug 2023 11:30:12 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "64e9e244-528e"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yH39Ak%2FYn6uCW7kKKSWiD1Y4NrM5njy4ticr4%2BjJbNLUJZLRuxToOvIjSV8IuFVYQ%2FeQEuttoDASYJGGLng%2Bo1ex0fU1Ho%2Bkzv1sEHyVQb16sr4EdukBN90iBOG7ifbxclbvQg3sj3NE"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 828e7d86493db939-AMS
alt-svc: h3=":443"; ma=86400
content-length: 21134

GET
H3 200 top.png
bem999.com/static/img/ 713 B
1 KB 572ms
572ms Image
image/png 2606:4700:3033::6815:1c45
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bem999.com/static/img/top.png
Requested by: Host: bem999.com
URL: https://bem999.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:1c45 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a0aa21f8efc227ff1560a50017e98ac01995d959639394bcce7cd288402363c4

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://bem999.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 20 Nov 2023 06:03:32 GMT
cf-cache-status: REVALIDATED
last-modified: Sat, 26 Aug 2023 11:30:12 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "64e9e244-2c9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MA89YpsdIgrE44Wr761Kgpr%2FwYkjssvhWGermfvvj7qNpnJgZ2BNaSIG%2FBO5LAmmepqDx9K%2B6W3REIki2sM%2BgXLGIGQFZeESuH3HqBvFa02qcQUajJMg%2B39ou6t03%2BDdHXqgzIZvFqF6"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 828e7d86493eb939-AMS
alt-svc: h3=":443"; ma=86400
content-length: 713

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e938d3c6623a2a3a998dcf76305f3f62666615d34e4e974ef4c3804555fa9c13

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 294f85fe3be823f6c150490fc22e2b35c7c578734e4ce7c7a4e5d4ad3076194f

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5e2075b12f16301a25f20865e46282ac75783326e41ee326a92545b372bf25ba

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 01fbfbf382c11d24260dac8565bf00d1c861934cfe1c49d7ca526474bc0aec79

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f83e87bff92bed71684e39aa5d5e43cfb1610f1338a8d0426ef6c2a0e13dcaa1

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 110d5b251602c7b2f2f124594b7ade38d5a51156c093a33c4d6839a865a82e69

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 indexList Show response
pwa.bem999.com/api/app/ 13 KB
4 KB 277ms
277ms XHR
application/json 2606:4700:3033::6815:1c45
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pwa.bem999.com/api/app/indexList
Requested by: Host: bem999.com
URL: https://bem999.com/static/js/chunk-vendors.f3031c62.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::6815:1c45 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5ce08b62e65eb80936427b4443b6d1557a153ba52badf4f833e2ed76f3cfbe69

Request headers

Accept: application/json, text/plain, */*
Lang: en
Referer: https://bem999.com/
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 20 Nov 2023 06:03:32 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aIEpwk60oIi0n2z4zXP0PeZBkkhjcB6ek3k%2FfjJsL9OMjcAZWGyaOYBX3Q86v7hHGda4ErZ7SHoKuHi89tFaW5xheMU1KP%2FIgqIhCUbk3U6iybgX5pZz10s4A2sCL444pzGb%2F%2BeQ2ROVntwyPw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://bem999.com
access-control-expose-headers: Authorization
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 828e7d8978890bea-AMS
alt-svc: h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Cloudflare (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.bem000.com/	1970-01-20 16:22:26	Name: __cf_mw_byp Value: jiAUJpCWU6RIPglTb5Dt5hj8xznLFp0tIVs96_9EsKo-1700460206-0-/

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bem000.com
bem999.com
config.oex2.xyz
pwa.bem999.com
2606:4700:3033::6815:1c45
2a06:98c1:3121::3
01fbfbf382c11d24260dac8565bf00d1c861934cfe1c49d7ca526474bc0aec79
1103290e25ebda2712abe344a87facbac00ddaba712729be9fe5feef807bf91b
110d5b251602c7b2f2f124594b7ade38d5a51156c093a33c4d6839a865a82e69
14efc517b8a4a8b2e50e5e0dd12bc120a716cee0a8471edb31218b8a5d53100a
294f85fe3be823f6c150490fc22e2b35c7c578734e4ce7c7a4e5d4ad3076194f
33f21fef741fdc9facb01361aa254aa98c50e6d30753114a998f2874228f0386
5513f7a164c094e10a208e18ff0e55da32a2c476840ff05d739ee1ed7384a2cf
5ce08b62e65eb80936427b4443b6d1557a153ba52badf4f833e2ed76f3cfbe69
5e2075b12f16301a25f20865e46282ac75783326e41ee326a92545b372bf25ba
7b583b987ab9038c6cbd734d86f27963588bdc3909643334191497a1b0541dc6
858f4e3bd9961c7c32cdff87460ee8842a3d41a9ff976fa92a30733456bff7d7
92f4715c1cd27be2d9862f150f75ec2bb17902c14cab2c2a761fb478a7fb56e2
93391d2f28d4c135aaf4d298e17070fc9a413a1ebfda1b9d7ba304bf849d88b1
9c660f9252dfe12a6072fb38088fd444df33cc01094ccf547ce99b32b98e4b0a
a0aa21f8efc227ff1560a50017e98ac01995d959639394bcce7cd288402363c4
a6efbd988540bf6b1658f34a15776fdf95b2d73b0b2393aa0798ff83994cf7fe
a8db14b17cf8e75685f8bd8945a369ea0581cf03f46da4347acb9c44d82f2221
b32881c15b19510defea492e550ee4baf864b67d9eb6518e5350abfcdd338e55
bb8e6401ae9fefc44d283c945894315b23028bc2268e254217af97440ef2e92b
d7b00ea03713a00ecf98a84b6ee5ab9110aeca9a85263fcb670d254a5f30927d
e938d3c6623a2a3a998dcf76305f3f62666615d34e4e974ef4c3804555fa9c13
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
f83e87bff92bed71684e39aa5d5e43cfb1610f1338a8d0426ef6c2a0e13dcaa1

bem999.com Open in urlscan Pro 2606:4700:3033::6815:1c45 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

17 Requests

82 %HTTPS

100 %IPv6

3 Domains

4 Subdomains

3 IPs

1 Countries

1279 kBTransfer

2898 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 7 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

1 Cookies

Security Headers

Indicators

bem999.com Open in urlscan Pro
2606:4700:3033::6815:1c45 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

82 %
HTTPS

100 %
IPv6

3
Domains

4
Subdomains

3
IPs

1
Countries

1279 kB
Transfer

2898 kB
Size

1
Cookies

17 HTTP transactions
7 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!