zerotrf.shop Open in urlscan Pro
152.89.196.229  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
10 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response zerotrf.shop/lander/ts2/	91 KB 35 KB	290ms 128ms	Document text/html	152.89.196.229 CHANGWAY-AS
General Check archive.org Show headers Download Go to Full URL http://zerotrf.shop/lander/ts2/ Protocol HTTP/1.1 Server 152.89.196.229 , Russian Federation, ASN57523 (CHANGWAY-AS, HK), Reverse DNS Software nginx / Resource Hash f78b7e38eff24289b5ed8f79d9c5d2fc98edae7d9c907cdd282b8f1e87a95d41 Security Headers Name Value X-Content-Type-Options nosniff Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 accept-language en-US,en;q=0.9 Response headers Connection keep-alive Content-Encoding gzip Content-Type text/html Date Thu, 12 Jan 2023 15:24:28 GMT ETag W/"63a2c6ac-16c6b" Last-Modified Wed, 21 Dec 2022 08:41:16 GMT Server nginx Transfer-Encoding chunked X-Content-Type-Options nosniff
GET H2	200	bootstrap.min.css cdn.jsdelivr.net/npm/bootstrap@4.6.0/dist/css/	158 KB 24 KB	153ms 78ms	Stylesheet text/css	2a04:4e42:600::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/bootstrap@4.6.0/dist/css/bootstrap.min.css Requested by Host: zerotrf.shop URL: http://zerotrf.shop/lander/ts2/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 4ffcc598ee6cff4692c1cea272cd8a2f195f6dec32473e94370d6cdcfa5fe601 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer http://zerotrf.shop/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload date Thu, 12 Jan 2023 15:24:28 GMT x-content-type-options nosniff content-encoding gzip age 7203661 x-jsd-version 4.6.0 x-cache HIT, HIT cross-origin-resource-policy cross-origin alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 24100 x-served-by cache-fra-eddf8230103-FRA, cache-chi-klot8100069-CHI x-jsd-version-type version etag W/"27681-LKxK/BIJg5IUESlr1Oj9ipS6I34" vary Accept-Encoding content-type text/css; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable accept-ranges bytes timing-allow-origin *
GET H2	200	css2 fonts.googleapis.com/	26 KB 2 KB	438ms 94ms	Stylesheet text/css	2607:f8b0:4006:80d::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&display=swap Requested by Host: zerotrf.shop URL: http://zerotrf.shop/lander/ts2/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:80d::200a , United States, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash cc140ef1e7c5d527ebb4e2e73107909cd646fd0bbdb10ebad305166c8c1b5204 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer http://zerotrf.shop/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Thu, 12 Jan 2023 15:24:28 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Thu, 12 Jan 2023 14:05:07 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Thu, 12 Jan 2023 15:24:28 GMT
GET H2	200	jquery-2.2.4.min.js Show response code.jquery.com/	84 KB 30 KB	447ms 102ms	Script application/javascript	2001:4de0:ac18::1:a:3a STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-2.2.4.min.js Requested by Host: zerotrf.shop URL: http://zerotrf.shop/lander/ts2/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:3a , Netherlands, ASN20446 (STACKPATH-CDN, US), Reverse DNS Software nginx / Resource Hash 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e Request headers accept-language en-US,en;q=0.9 Referer http://zerotrf.shop/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Thu, 12 Jan 2023 15:24:28 GMT content-encoding gzip x-sp-metadata HS256.CLzogJ4GEosBCiRhODFmYzA4NC0zYzVkLTQ1M2EtODNkMS00Yzg2Mzc4ZWFhMTkQ+OiCoKvU+wIaBgiszICeBiIQMjYwMjpmZmM4OjE6MTo6Nyi8uwMwAzgEQhZUTFNfQUVTXzEyOF9HQ01fU0hBMjU2WiAzZTliMjA2MTAwOThiNmM5YmZmOTUzODU2ZTU4MDE2YRosCAESJGMxOGRmY2RiLWIwMGMtNDI3Zi05ZThhLWVmZWMwOGI5ZTYyMRjz6AEiGAgCEhRjZHMyMzEuY2g0Lmh3Y2RuLm5ldA==.QgkiJfkAzHoOAAn+nA7HeVJOhPkcH02TIDihiWrGdhQ= last-modified Fri, 20 Aug 2021 17:47:53 GMT server nginx etag W/"611feac9-14e4a" vary Accept-Encoding x-hw 1673537068.dop003.ch4.t,1673537068.cds225.ch4.hn,1673537068.cds231.ch4.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 29811
GET H2	200	font-awesome.min.css maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/	27 KB 7 KB	472ms 130ms	Stylesheet text/css	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/font-awesome.min.css Requested by Host: zerotrf.shop URL: http://zerotrf.shop/lander/ts2/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ddd92f10ad162c7449eff0acaf40598c05b1111739587edb75e5326b6697c5d5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer http://zerotrf.shop/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Thu, 12 Jan 2023 15:24:28 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-encoding br cdn-edgestorageid 940 age 5458598 cdn-cachedat 07/06/2022 16:35:57 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Mon, 25 Jan 2021 22:04:54 GMT cdn-proxyver 1.02 cdn-requestpullcode 200 server cloudflare etag W/"4fbd15cb6047af93373f4f895639c8bf" vary Accept-Encoding content-type text/css; charset=utf-8 access-control-allow-origin * cdn-cache HIT cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cache-control public, max-age=31919000 cdn-requestid c2ac29fefd200cd8a80bd09221b23858 timing-allow-origin * cdn-requestcountrycode US cdn-status 200 cf-ray 7886e637bc47e226-ORD cdn-requestpullsuccess True
GET H/1.1	200 OK	1.jpg zerotrf.shop/lander/ts2/	130 KB 131 KB	181ms 130ms	Image image/jpeg	152.89.196.229 CHANGWAY-AS
General Check archive.org Show headers Download Go to Show image Full URL http://zerotrf.shop/lander/ts2/1.jpg Requested by Host: zerotrf.shop URL: http://zerotrf.shop/lander/ts2/ Protocol HTTP/1.1 Server 152.89.196.229 , Russian Federation, ASN57523 (CHANGWAY-AS, HK), Reverse DNS Software nginx / Resource Hash 2ed48437101385b0d5e25fca0f8d841410e9d7f1012dabfcd7d43b6eb21637c2 Request headers accept-language en-US,en;q=0.9 Referer http://zerotrf.shop/lander/ts2/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Date Thu, 12 Jan 2023 15:24:29 GMT Last-Modified Sun, 18 Dec 2022 18:47:12 GMT Server nginx ETag "639f6030-20958" Content-Type image/jpeg Access-Control-Allow-Origin * Cache-Control max-age=864000 Connection keep-alive Accept-Ranges bytes Content-Length 133464 Expires Sun, 22 Jan 2023 15:24:29 GMT
GET H/1.1	200 OK	2.jpg zerotrf.shop/lander/ts2/	50 KB 50 KB	356ms 130ms	Image image/jpeg	152.89.196.229 CHANGWAY-AS
General Check archive.org Show headers Download Go to Show image Full URL http://zerotrf.shop/lander/ts2/2.jpg Requested by Host: zerotrf.shop URL: http://zerotrf.shop/lander/ts2/ Protocol HTTP/1.1 Server 152.89.196.229 , Russian Federation, ASN57523 (CHANGWAY-AS, HK), Reverse DNS Software nginx / Resource Hash ef7a780f7873dd7692e694f4e06a0d61ce24d2a12d14d22793459ec0ade299d6 Request headers accept-language en-US,en;q=0.9 Referer http://zerotrf.shop/lander/ts2/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Date Thu, 12 Jan 2023 15:24:29 GMT Last-Modified Sun, 18 Dec 2022 18:47:12 GMT Server nginx ETag "639f6030-c7b2" Content-Type image/jpeg Access-Control-Allow-Origin * Cache-Control max-age=864000 Connection keep-alive Accept-Ranges bytes Content-Length 51122 Expires Sun, 22 Jan 2023 15:24:29 GMT
GET H2	200	modernizr.min.js Show response cdnjs.cloudflare.com/ajax/libs/modernizr/2.8.3/	11 KB 5 KB	314ms 13ms	Script application/javascript	2606:4700::6811:180e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/modernizr/2.8.3/modernizr.min.js Requested by Host: zerotrf.shop URL: http://zerotrf.shop/lander/ts2/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d2b82e612d2a812e8be2a57300dab8923c4f2edbe7a799e7da70791b595646fe Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer http://zerotrf.shop/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Thu, 12 Jan 2023 15:24:29 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 596819 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 3980 last-modified Mon, 04 May 2020 16:13:26 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03f26-2b4c" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qVmHDOUtPD9ExTS5pYCdvYmXAVTJOhvPTP5nNvsU93SgvCUbsw5Yp4ys156vMXb5W0VuC%2Fbhi9HsPAWrQ%2FSfZE5CxalvAhsmFTlst4fIcFFGDgygxzHrnujSdCq8pz7niW4VnPLybby605omnGuKJOam"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 7886e63a9ebf21af-ORD expires Tue, 02 Jan 2024 15:24:29 GMT
GET H3	200	bootstrap.bundle.min.js Show response cdn.jsdelivr.net/npm/bootstrap@4.6.0/dist/js/	82 KB 22 KB	264ms 148ms	Script application/javascript	2a04:4e42:600::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/bootstrap@4.6.0/dist/js/bootstrap.bundle.min.js Requested by Host: zerotrf.shop URL: http://zerotrf.shop/lander/ts2/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash b0212543cc5a4a0a31c1b5a9d1e8973261992116b4cfde3e7dfcf33b4e81a97b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer http://zerotrf.shop/ Origin http://zerotrf.shop accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload date Thu, 12 Jan 2023 15:24:29 GMT x-content-type-options nosniff content-encoding gzip age 6870982 x-jsd-version 4.6.0 x-cache HIT, HIT cross-origin-resource-policy cross-origin alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 21830 x-served-by cache-fra-eddf8230138-FRA, cache-chi-klot8100030-CHI x-jsd-version-type version etag W/"1499a-rsVR5NVzRjCI/KfRT7ZE6zifGDk" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable accept-ranges bytes timing-allow-origin *
GET DATA	200 OK	truncated /	173 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f62f048fbb29a755631380c91cebeeb8a86d7e046221795bd70baccdfa86dc2e Request headers accept-language en-US,en;q=0.9 Referer http://zerotrf.shop/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	144 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 903583bb294f41c7cccf8141382177d5ffa2f37cc8b3ac95db412dcbb37e7351 Request headers accept-language en-US,en;q=0.9 Referer http://zerotrf.shop/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	226 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash a20f67222791a6c586f0765c97d569cc578b666d3d0e47a7f2bd129e4fe64e27 Request headers accept-language en-US,en;q=0.9 Referer http://zerotrf.shop/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	230 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f933a7ccf1a63317b347fa1e0769965a4f1c063df3e8e617a53ddf219808981d Request headers accept-language en-US,en;q=0.9 Referer http://zerotrf.shop/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	12 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 8bcb650160ca6d0f48023b7c5ec36248b3306c65ea782fb58459b4c810d23279 Request headers accept-language en-US,en;q=0.9 Referer http://zerotrf.shop/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Content-Type image/png
GET H2	200	KFOlCnqEu92Fr1MmWUlfBBc4.woff2 fonts.gstatic.com/s/roboto/v30/	15 KB 16 KB	604ms 51ms	Font font/woff2	2607:f8b0:4006:81f::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:81f::2003 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin http://zerotrf.shop accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Wed, 11 Jan 2023 19:32:04 GMT x-content-type-options nosniff age 71545 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15860 x-xss-protection 0 last-modified Wed, 11 May 2022 19:24:42 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Thu, 11 Jan 2024 19:32:04 GMT
GET H2	200	KFOmCnqEu92Fr1Mu4mxK.woff2 fonts.gstatic.com/s/roboto/v30/	15 KB 15 KB	616ms 63ms	Font font/woff2	2607:f8b0:4006:81f::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:81f::2003 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin http://zerotrf.shop accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Fri, 06 Jan 2023 10:24:38 GMT x-content-type-options nosniff age 536391 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15744 x-xss-protection 0 last-modified Wed, 11 May 2022 19:24:48 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sat, 06 Jan 2024 10:24:38 GMT
GET H/1.1	404 Not Found	0wa0rni0ng0.mp3 zerotrf.shop/lander/ts2/	548 B 696 B	359ms 160ms	Media text/html	152.89.196.229 CHANGWAY-AS
General Check archive.org Show headers Download Go to Full URL http://zerotrf.shop/lander/ts2/0wa0rni0ng0.mp3 Requested by Host: zerotrf.shop URL: http://zerotrf.shop/lander/ts2/ Protocol HTTP/1.1 Server 152.89.196.229 , Russian Federation, ASN57523 (CHANGWAY-AS, HK), Reverse DNS Software nginx / Resource Hash d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090 Request headers Referer http://zerotrf.shop/lander/ts2/ Accept-Encoding identity;q=1, *;q=0 accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Range bytes=0- Response headers Date Thu, 12 Jan 2023 15:24:29 GMT Server nginx Connection keep-alive Content-Length 548 Content-Type text/html
GET DATA	200 OK	truncated /	239 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 4a3421b42cbba578920cadb4e5fe8f4052f49ad4633f04464bcb34d016f4a14f Request headers accept-language en-US,en;q=0.9 Referer http://zerotrf.shop/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	3 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 81d37206f20d5b5f2471324323d9755c1745d52066147c0aa95b2cb19d6a6465 Request headers accept-language en-US,en;q=0.9 Referer http://zerotrf.shop/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 3eeefb1c09a9e49f697208c13ed755ecda0d848e94653d6448725c8722081a1c Request headers accept-language en-US,en;q=0.9 Referer http://zerotrf.shop/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	3 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 9bf84216ea2f792174f07a4eb593d71cf0525aab7471e2a70358c76243695720 Request headers accept-language en-US,en;q=0.9 Referer http://zerotrf.shop/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	3 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash bf8aac766e555530791cdd570abef334c53c9b5d37f3583b7af39262274615f9 Request headers accept-language en-US,en;q=0.9 Referer http://zerotrf.shop/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Content-Type image/png
GET H/1.1	404 Not Found	alertmicrosoft.mp3 zerotrf.shop/lander/ts2/	548 B 696 B	135ms 134ms	Media text/html	152.89.196.229 CHANGWAY-AS
General Check archive.org Show headers Download Go to Full URL http://zerotrf.shop/lander/ts2/alertmicrosoft.mp3 Requested by Host: zerotrf.shop URL: http://zerotrf.shop/lander/ts2/ Protocol HTTP/1.1 Server 152.89.196.229 , Russian Federation, ASN57523 (CHANGWAY-AS, HK), Reverse DNS Software nginx / Resource Hash d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090 Request headers Referer http://zerotrf.shop/lander/ts2/ Accept-Encoding identity;q=1, *;q=0 accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Range bytes=0- Response headers Date Thu, 12 Jan 2023 15:24:29 GMT Server nginx Connection keep-alive Content-Length 548 Content-Type text/html
GET H2	200	KFOlCnqEu92Fr1MmEU9fBBc4.woff2 fonts.gstatic.com/s/roboto/v30/	16 KB 16 KB	47ms 45ms	Font font/woff2	2607:f8b0:4006:81f::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:81f::2003 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin http://zerotrf.shop accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Wed, 11 Jan 2023 02:49:38 GMT x-content-type-options nosniff age 131693 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15920 x-xss-protection 0 last-modified Wed, 11 May 2022 19:24:45 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Thu, 11 Jan 2024 02:49:38 GMT
GET H3	200	fontawesome-webfont.woff2 maxcdn.bootstrapcdn.com/font-awesome/4.5.0/fonts/	65 KB 66 KB	63ms 36ms	Font font/woff2	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/font-awesome/4.5.0/fonts/fontawesome-webfont.woff2?v=4.5.0 Requested by Host: maxcdn.bootstrapcdn.com URL: https://maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/font-awesome.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ff82aeed6b9bb6701696c84d1b223d2e682eb78c89117a438ce6cfea8c498995 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/font-awesome.min.css Origin http://zerotrf.shop accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Thu, 12 Jan 2023 15:24:32 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 1067 age 276434 cdn-cachedat 12/23/2022 08:50:57 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 66624 last-modified Mon, 25 Jan 2021 22:04:54 GMT cdn-proxyver 1.03 cdn-requestpullcode 200 server cloudflare etag "db812d8a70a4e88e888744c1c9a27e89" vary Accept-Encoding content-type font/woff2 access-control-allow-origin * cdn-cache HIT cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cache-control public, max-age=31919000 cdn-requestid 1d1c93c8eae4b04e44a22186a010a4c4 accept-ranges bytes timing-allow-origin * cdn-requestcountrycode US cdn-status 200 cf-ray 7886e64d797ec530-ORD cdn-requestpullsuccess True

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Tech Support Scam (Consumer)

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| $ function| jQuery string| img1 string| img2 string| img3 string| img4 string| img5 string| img6 string| img7 string| img8 string| img9 string| img10 object| html5 object| Modernizr object| bootstrap function| addEvent object| modal object| btn undefined| span

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://zerotrf.shop/lander/ts2/0wa0rni0ng0.mp3 Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://zerotrf.shop/lander/ts2/alertmicrosoft.mp3 Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
cdnjs.cloudflare.com
code.jquery.com
fonts.googleapis.com
fonts.gstatic.com
maxcdn.bootstrapcdn.com
zerotrf.shop
152.89.196.229
2001:4de0:ac18::1:a:3a
2606:4700::6811:180e
2606:4700::6812:bcf
2607:f8b0:4006:80d::200a
2607:f8b0:4006:81f::2003
2a04:4e42:600::485
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
2ed48437101385b0d5e25fca0f8d841410e9d7f1012dabfcd7d43b6eb21637c2
3eeefb1c09a9e49f697208c13ed755ecda0d848e94653d6448725c8722081a1c
4a3421b42cbba578920cadb4e5fe8f4052f49ad4633f04464bcb34d016f4a14f
4ffcc598ee6cff4692c1cea272cd8a2f195f6dec32473e94370d6cdcfa5fe601
81d37206f20d5b5f2471324323d9755c1745d52066147c0aa95b2cb19d6a6465
8bcb650160ca6d0f48023b7c5ec36248b3306c65ea782fb58459b4c810d23279
903583bb294f41c7cccf8141382177d5ffa2f37cc8b3ac95db412dcbb37e7351
9bf84216ea2f792174f07a4eb593d71cf0525aab7471e2a70358c76243695720
a20f67222791a6c586f0765c97d569cc578b666d3d0e47a7f2bd129e4fe64e27
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b0212543cc5a4a0a31c1b5a9d1e8973261992116b4cfde3e7dfcf33b4e81a97b
bf8aac766e555530791cdd570abef334c53c9b5d37f3583b7af39262274615f9
cc140ef1e7c5d527ebb4e2e73107909cd646fd0bbdb10ebad305166c8c1b5204
d2b82e612d2a812e8be2a57300dab8923c4f2edbe7a799e7da70791b595646fe
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090
ddd92f10ad162c7449eff0acaf40598c05b1111739587edb75e5326b6697c5d5
ef7a780f7873dd7692e694f4e06a0d61ce24d2a12d14d22793459ec0ade299d6
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f62f048fbb29a755631380c91cebeeb8a86d7e046221795bd70baccdfa86dc2e
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f78b7e38eff24289b5ed8f79d9c5d2fc98edae7d9c907cdd282b8f1e87a95d41
f933a7ccf1a63317b347fa1e0769965a4f1c063df3e8e617a53ddf219808981d
ff82aeed6b9bb6701696c84d1b223d2e682eb78c89117a438ce6cfea8c498995