urlscan.io logo urlscan.io
SecurityTrails logo

cdn.groupme.quest Open in urlscan Pro
2606:4700:3035::6815:5c5  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://claim.groupme.quest:443/
Effective URL: https://cdn.groupme.quest/sweep/survey/?project=GroupMe&color=2cacf0&prize=iPhone%2015%20PRO&lprice=$1200&nprice=$1&color=...
Submission: On August 06 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 13 HTTP transactions. The main IP is 2606:4700:3035::6815:5c5, located in United States and belongs to CLOUDFLARENET, US. The main domain is cdn.groupme.quest.
TLS certificate: Issued by WE1 on June 15th 2024. Valid for: 3 months.
This is the only time cdn.groupme.quest was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Cloudflare (Online)

Domain & IP information

IP Address AS Autonomous System
3 12 2606:4700:303... 13335 (CLOUDFLAR...)
1 3 2a06:98c1:312... 13335 (CLOUDFLAR...)
13 3
Apex Domain
Subdomains		 Transfer
12 groupme.quest
claim.groupme.quest
cdn.groupme.quest
68 KB
3 trkclk8.space
trk.trkclk8.space
api.trkclk8.space Failed
2 KB
0 funredir.com Failed
cdn.funredir.com Failed
13 3
Domain Requested by
7 cdn.groupme.quest 1 redirects cdn.groupme.quest
5 claim.groupme.quest 2 redirects claim.groupme.quest
3 trk.trkclk8.space 1 redirects cdn.groupme.quest
0 api.trkclk8.space Failed cdn.groupme.quest
0 cdn.funredir.com Failed
13 5

This site contains no links.

Subject Issuer Validity Valid
groupme.quest
WE1		 2024-06-15 -
2024-09-13		 3 months crt.sh
trkclk8.space
WE1		 2024-07-20 -
2024-10-18		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://cdn.groupme.quest/sweep/survey/?project=GroupMe&color=2cacf0&prize=iPhone%2015%20PRO&lprice=$1200&nprice=$1&color=2cacf0&t6=Unknown&uclick=ghzwpm&uclickhash=ghzwpm-ghzwgm-fe-0-fe-7s6o-7sdz-958889
Frame ID: 235309EEE981B9744E3E4A4C751A25A4
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

GroupMe | Congratulation!

Page URL History Show full URLs

  1. http://claim.groupme.quest:443/ HTTP 307
    https://claim.groupme.quest/ Page URL
  2. https://claim.groupme.quest/cdn-cgi/phish-bypass?atok=5ow9.wWE3SohMMd._xC7pdwvsFwirmUpoUxKJSLVStA-172290... HTTP 301
    https://claim.groupme.quest/ HTTP 302
    https://trk.trkclk8.space/click.php?key=i5jx1v1bs1sae0dkk0lf&&sub=claim&domain=groupme&zone=quest&path= HTTP 302
    https://cdn.groupme.quest/sweep/survey?project=GroupMe&color=2cacf0&prize=iPhone%2015%20PRO&lprice=$12... HTTP 301
    http://cdn.groupme.quest/sweep/survey/?project=GroupMe&color=2cacf0&prize=iPhone%2015%20PRO&lprice=$1... HTTP 307
    https://cdn.groupme.quest/sweep/survey/?project=GroupMe&color=2cacf0&prize=iPhone%2015%20PRO&lprice=$1... Page URL

Page Statistics

13
Requests

85 %
HTTPS

100 %
IPv6

3
Domains

5
Subdomains

3
IPs

1
Countries

68 kB
Transfer

97 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://claim.groupme.quest:443/ HTTP 307
    https://claim.groupme.quest/ Page URL
  2. https://claim.groupme.quest/cdn-cgi/phish-bypass?atok=5ow9.wWE3SohMMd._xC7pdwvsFwirmUpoUxKJSLVStA-1722905840-0.0.1.1-%2F HTTP 301
    https://claim.groupme.quest/ HTTP 302
    https://trk.trkclk8.space/click.php?key=i5jx1v1bs1sae0dkk0lf&&sub=claim&domain=groupme&zone=quest&path= HTTP 302
    https://cdn.groupme.quest/sweep/survey?project=GroupMe&color=2cacf0&prize=iPhone%2015%20PRO&lprice=$1200&nprice=$1&color=2cacf0&t6=Unknown&uclick=ghzwpm&uclickhash=ghzwpm-ghzwgm-fe-0-fe-7s6o-7sdz-958889 HTTP 301
    http://cdn.groupme.quest/sweep/survey/?project=GroupMe&color=2cacf0&prize=iPhone%2015%20PRO&lprice=$1200&nprice=$1&color=2cacf0&t6=Unknown&uclick=ghzwpm&uclickhash=ghzwpm-ghzwgm-fe-0-fe-7s6o-7sdz-958889 HTTP 307
    https://cdn.groupme.quest/sweep/survey/?project=GroupMe&color=2cacf0&prize=iPhone%2015%20PRO&lprice=$1200&nprice=$1&color=2cacf0&t6=Unknown&uclick=ghzwpm&uclickhash=ghzwpm-ghzwgm-fe-0-fe-7s6o-7sdz-958889 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://claim.groupme.quest:443/ HTTP 307
  • https://claim.groupme.quest/
Request Chain 3
  • https://claim.groupme.quest/favicon.ico HTTP 302
  • https://trk.trkclk8.space/click.php?key=i5jx1v1bs1sae0dkk0lf&&sub=claim&domain=groupme&zone=quest&path=favicon.ico HTTP 302
  • https://cdn.funredir.com/dating/18/?uclick=ghzwpm&uclickhash=ghzwpm-ghzwus-q5-0-qd-qd8n-lpfe-d9d69a

13 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
claim.groupme.quest/
Redirect Chain
  • http://claim.groupme.quest:443/
  • https://claim.groupme.quest/
4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://claim.groupme.quest/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::6815:5c5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
727fb6749a758280cc5efd4a0d301e26e2c4ae05b7cc6181a2d4962210a76179
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

cf-ray
8aeb127d8b2c1ac5-FRA
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 06 Aug 2024 00:57:20 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dTeDd1W%2FX9m%2FGllbZEI6dW1KojoR51EygVfbAjL77yv5WFjI0YfE%2BdRzaTX%2FrgM1JO8MtGkj4atvGzPgPTjS1GEXb1tpUyF5naaO3eF4oeCebS97%2BAGvIFR3xC3QIPs8%2Fwugi3doZe3BB%2FvBblbrZfHr"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-frame-options
SAMEORIGIN

Redirect headers

Location
https://claim.groupme.quest/
Non-Authoritative-Reason
HttpsUpgrades
cf.errors.css
claim.groupme.quest/cdn-cgi/styles/ 		23 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://claim.groupme.quest/cdn-cgi/styles/cf.errors.css
Requested by
Host: claim.groupme.quest
URL: https://claim.groupme.quest/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::6815:5c5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://claim.groupme.quest/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Tue, 06 Aug 2024 00:57:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 30 Jul 2024 21:55:42 GMT
server
cloudflare
etag
W/"66a9615e-5df3"
x-frame-options
DENY
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=7200, public
cf-ray
8aeb127dbb751ac5-FRA
expires
Tue, 06 Aug 2024 02:57:20 GMT
icon-exclamation.png
claim.groupme.quest/cdn-cgi/images/ 		452 B
634 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://claim.groupme.quest/cdn-cgi/images/icon-exclamation.png?1376755637
Requested by
Host: claim.groupme.quest
URL: https://claim.groupme.quest/cdn-cgi/styles/cf.errors.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::6815:5c5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://claim.groupme.quest/cdn-cgi/styles/cf.errors.css
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Tue, 06 Aug 2024 00:57:20 GMT
x-content-type-options
nosniff
last-modified
Tue, 30 Jul 2024 21:55:42 GMT
server
cloudflare
etag
"66a9615e-1c4"
x-frame-options
DENY
vary
Accept-Encoding
content-type
image/png
cache-control
max-age=7200, public
accept-ranges
bytes
cf-ray
8aeb127debcf1ac5-FRA
content-length
452
expires
Tue, 06 Aug 2024 02:57:20 GMT
/
cdn.funredir.com/dating/18/
Redirect Chain
  • https://claim.groupme.quest/favicon.ico
  • https://trk.trkclk8.space/click.php?key=i5jx1v1bs1sae0dkk0lf&&sub=claim&domain=groupme&zone=quest&path=favicon.ico
  • https://cdn.funredir.com/dating/18/?uclick=ghzwpm&uclickhash=ghzwpm-ghzwus-q5-0-qd-qd8n-lpfe-d9d69a
0
0
Primary Request /
cdn.groupme.quest/sweep/survey/
Redirect Chain
  • https://claim.groupme.quest/cdn-cgi/phish-bypass?atok=5ow9.wWE3SohMMd._xC7pdwvsFwirmUpoUxKJSLVStA-1722905840-0.0.1.1-%2F
  • https://claim.groupme.quest/
  • https://trk.trkclk8.space/click.php?key=i5jx1v1bs1sae0dkk0lf&&sub=claim&domain=groupme&zone=quest&path=
  • https://cdn.groupme.quest/sweep/survey?project=GroupMe&color=2cacf0&prize=iPhone%2015%20PRO&lprice=$1200&nprice=$1&color=2cacf0&t6=Unknown&uclick=ghzwpm&uclickhash=ghzwpm-ghzwgm-fe-0-fe-7s6o-7sdz-9...
  • http://cdn.groupme.quest/sweep/survey/?project=GroupMe&color=2cacf0&prize=iPhone%2015%20PRO&lprice=$1200&nprice=$1&color=2cacf0&t6=Unknown&uclick=ghzwpm&uclickhash=ghzwpm-ghzwgm-fe-0-fe-7s6o-7sdz-9...
  • https://cdn.groupme.quest/sweep/survey/?project=GroupMe&color=2cacf0&prize=iPhone%2015%20PRO&lprice=$1200&nprice=$1&color=2cacf0&t6=Unknown&uclick=ghzwpm&uclickhash=ghzwpm-ghzwgm-fe-0-fe-7s6o-7sdz-...
14 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://cdn.groupme.quest/sweep/survey/?project=GroupMe&color=2cacf0&prize=iPhone%2015%20PRO&lprice=$1200&nprice=$1&color=2cacf0&t6=Unknown&uclick=ghzwpm&uclickhash=ghzwpm-ghzwgm-fe-0-fe-7s6o-7sdz-958889
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::6815:5c5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
710fb2016a783afe4bfa5ea7f87311a2ba9632547fc4b839beebb32c89189de7

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8aeb129f7bae360f-FRA
content-encoding
br
content-type
text/html
date
Tue, 06 Aug 2024 00:57:25 GMT
last-modified
Thu, 04 Apr 2024 12:57:06 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eEzka7CQ8PemxFYx%2BgCzC%2BKrRSzOon%2BpSrR35UK1PKkonA8mBFY6J5pj4OdX8yhuazpXyIIsTedj927VKRBEy1i6WRPPI8nXOlDJQP8CgzP5FQFfYx5c8HiMo9EmDZn9dzgn6UZNEnjnkxCoUJnCQw%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare

Redirect headers

Location
https://cdn.groupme.quest/sweep/survey/?project=GroupMe&color=2cacf0&prize=iPhone%2015%20PRO&lprice=$1200&nprice=$1&color=2cacf0&t6=Unknown&uclick=ghzwpm&uclickhash=ghzwpm-ghzwgm-fe-0-fe-7s6o-7sdz-958889
Non-Authoritative-Reason
HttpsUpgrades
common.js
cdn.groupme.quest/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.groupme.quest/common.js
Requested by
Host: cdn.groupme.quest
URL: https://cdn.groupme.quest/sweep/survey/?project=GroupMe&color=2cacf0&prize=iPhone%2015%20PRO&lprice=$1200&nprice=$1&color=2cacf0&t6=Unknown&uclick=ghzwpm&uclickhash=ghzwpm-ghzwgm-fe-0-fe-7s6o-7sdz-958889
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::6815:5c5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
41491d91d2ef4874b59329f5591d94bf4d87315f7d208208ec5d0c949d20fb61

Request headers

Referer
https://cdn.groupme.quest/sweep/survey/?project=GroupMe&color=2cacf0&prize=iPhone%2015%20PRO&lprice=$1200&nprice=$1&color=2cacf0&t6=Unknown&uclick=ghzwpm&uclickhash=ghzwpm-ghzwgm-fe-0-fe-7s6o-7sdz-958889
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Tue, 06 Aug 2024 00:57:25 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 24 Jul 2024 17:26:30 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"66a13946-1259"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OBdp%2FxJPQDs7KIZjd1EYqqskHvSpI3D0cxzPB6BaBv8NgQeUBnWahM%2BYsMVIf7GSCsCLMN86B0eZ7GSHzAeghBawjuYu47yegG0Ga%2BKjdgR3OvawBybuwOmAiuZu4doACLRWoOsTq1UreKMOrqXYag%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
8aeb129fb9a63675-FRA
alt-svc
h3=":443"; ma=86400
click.php
trk.trkclk8.space/ 		0
423 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trk.trkclk8.space/click.php?event1=1&uclick=ghzwpm
Requested by
Host: cdn.groupme.quest
URL: https://cdn.groupme.quest/sweep/survey/?project=GroupMe&color=2cacf0&prize=iPhone%2015%20PRO&lprice=$1200&nprice=$1&color=2cacf0&t6=Unknown&uclick=ghzwpm&uclickhash=ghzwpm-ghzwgm-fe-0-fe-7s6o-7sdz-958889
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://cdn.groupme.quest/sweep/survey/?project=GroupMe&color=2cacf0&prize=iPhone%2015%20PRO&lprice=$1200&nprice=$1&color=2cacf0&t6=Unknown&uclick=ghzwpm&uclickhash=ghzwpm-ghzwgm-fe-0-fe-7s6o-7sdz-958889
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Tue, 06 Aug 2024 00:57:25 GMT
strict-transport-security
max-age=31536000
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ht2Bvwm8PylbzH5eEczNQxcVkfviMdo5VfKKsgDMJjVU4gHwUTxrd8XfK9Tss7jL4BMozjvJ93e%2B6ETjXgwrdAn9c5XAIAWaQkU5xdmZf%2FUWGiR%2BMe5SAzvkS1vBl2dWi9aTTK0pm6fkF%2FBPfvvEqQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=UTF-8
cf-ray
8aeb12a01b28a020-FRA
alt-svc
h3=":443"; ma=86400
/
api.trkclk8.space/ 		0
0
groupme.png
cdn.groupme.quest/sweep/survey/images/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.groupme.quest/sweep/survey/images/groupme.png?1
Requested by
Host: cdn.groupme.quest
URL: https://cdn.groupme.quest/sweep/survey/?project=GroupMe&color=2cacf0&prize=iPhone%2015%20PRO&lprice=$1200&nprice=$1&color=2cacf0&t6=Unknown&uclick=ghzwpm&uclickhash=ghzwpm-ghzwgm-fe-0-fe-7s6o-7sdz-958889
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::6815:5c5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b4cedf0e26b0a43985524ee1828b078aaeeb52f4edd0e7a8a3e3481d5d388c01

Request headers

Referer
https://cdn.groupme.quest/sweep/survey/?project=GroupMe&color=2cacf0&prize=iPhone%2015%20PRO&lprice=$1200&nprice=$1&color=2cacf0&t6=Unknown&uclick=ghzwpm&uclickhash=ghzwpm-ghzwgm-fe-0-fe-7s6o-7sdz-958889
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Tue, 06 Aug 2024 00:57:25 GMT
cf-cache-status
MISS
last-modified
Sat, 20 Mar 2021 16:37:08 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"605624b4-d2b"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8XxKP%2FvP1ghVck4iZugZcItofZXY5L9tmchp3EeRNlvMDXCmKCYG5OixWd6jSSYFeHHa93CFU9d6W6f1GDviQuAFIV%2BSSPELVJWCKMOLZglrsygGO6n3S1%2FICCaCyKyhExzP1UmesQxTcJTw%2FNUbPQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
8aeb12a019e33675-FRA
alt-svc
h3=":443"; ma=86400
content-length
3371
iphone15pro.png
cdn.groupme.quest/sweep/survey/images/ 		31 KB
32 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.groupme.quest/sweep/survey/images/iphone15pro.png?1
Requested by
Host: cdn.groupme.quest
URL: https://cdn.groupme.quest/sweep/survey/?project=GroupMe&color=2cacf0&prize=iPhone%2015%20PRO&lprice=$1200&nprice=$1&color=2cacf0&t6=Unknown&uclick=ghzwpm&uclickhash=ghzwpm-ghzwgm-fe-0-fe-7s6o-7sdz-958889
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::6815:5c5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8fca56a327b9ea820b951c4bd38c1f30f44ad880a7905001617d7703941398e5

Request headers

Referer
https://cdn.groupme.quest/sweep/survey/?project=GroupMe&color=2cacf0&prize=iPhone%2015%20PRO&lprice=$1200&nprice=$1&color=2cacf0&t6=Unknown&uclick=ghzwpm&uclickhash=ghzwpm-ghzwgm-fe-0-fe-7s6o-7sdz-958889
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Tue, 06 Aug 2024 00:57:25 GMT
cf-cache-status
MISS
last-modified
Mon, 05 Feb 2024 12:55:25 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"65c0dabd-7c2b"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VNkLhBxxo69fH9JNXQORwms11tb%2B%2BBCYSrzG3Gb5JXs0iRMPT%2FrJgrkVaHQSHheKve%2FIoVVRw%2FHySNxZsH7Av%2FBTf4GZAfmalKrV81WrDv2BeShyiro8dw%2BY0245%2FGwhOU5GOI6EmhWoySIXaj5UMg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
8aeb12a019e63675-FRA
alt-svc
h3=":443"; ma=86400
content-length
31787
ODelI1aHBYDBqgeIAH2zlNV_2ngZ8dMf8fLgjYEouxg.woff2
cdn.groupme.quest/sweep/survey/fonts/ 		16 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cdn.groupme.quest/sweep/survey/fonts/ODelI1aHBYDBqgeIAH2zlNV_2ngZ8dMf8fLgjYEouxg.woff2
Requested by
Host: cdn.groupme.quest
URL: https://cdn.groupme.quest/sweep/survey/?project=GroupMe&color=2cacf0&prize=iPhone%2015%20PRO&lprice=$1200&nprice=$1&color=2cacf0&t6=Unknown&uclick=ghzwpm&uclickhash=ghzwpm-ghzwgm-fe-0-fe-7s6o-7sdz-958889
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::6815:5c5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cb992eae898417162c48b37712991d9ad8053c4a64fce51aff195edc69dc35f2

Request headers

Referer
https://cdn.groupme.quest/sweep/survey/?project=GroupMe&color=2cacf0&prize=iPhone%2015%20PRO&lprice=$1200&nprice=$1&color=2cacf0&t6=Unknown&uclick=ghzwpm&uclickhash=ghzwpm-ghzwgm-fe-0-fe-7s6o-7sdz-958889
Origin
https://cdn.groupme.quest
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Tue, 06 Aug 2024 00:57:25 GMT
cf-cache-status
MISS
last-modified
Wed, 20 May 2020 22:07:56 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"5ec5aa3c-3e24"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K4xJWXgSTvUnB6uKpEcG6BAh2cotOVAkdLws3RAdj%2BeYeh3iuV%2FJON2tL7elROpqomgyhM%2FAd8wYTyOKJA8%2FUj5406jJMln7ZBQH3UXe0fW%2B6y%2BUmnvKA%2F%2FPrLDsy5JrWZq%2BqMSD7QtJsCv29nO0jQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
font/woff2
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
8aeb12a019ea3675-FRA
alt-svc
h3=":443"; ma=86400
content-length
15908
click.php
trk.trkclk8.space/ 		0
424 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trk.trkclk8.space/click.php?event2=1&uclick=ghzwpm
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://cdn.groupme.quest/sweep/survey/?project=GroupMe&color=2cacf0&prize=iPhone%2015%20PRO&lprice=$1200&nprice=$1&color=2cacf0&t6=Unknown&uclick=ghzwpm&uclickhash=ghzwpm-ghzwgm-fe-0-fe-7s6o-7sdz-958889
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Tue, 06 Aug 2024 00:57:25 GMT
strict-transport-security
max-age=31536000
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cjXh0ZM15m91T9vnTMxmH4hjuiEzMUQvqF0jfMSjKlTcAnlAZ6pnQLpqzZQo1DOT9bWsR50ViQbpQQqIiTbGXyLnREtZd8E%2FOtm%2B7%2FSgsR7mFsLMqYnTJx708SMnb00saMmAK1%2B3qltwYLgB%2BaPqnw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=UTF-8
cf-ray
8aeb12a09b77a020-FRA
alt-svc
h3=":443"; ma=86400
favicon.png
cdn.groupme.quest/sweep/survey/images/ 		175 B
644 B 		Other
General
Check archive.org
Download Go to
Full URL
https://cdn.groupme.quest/sweep/survey/images/favicon.png
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::6815:5c5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4b0d67ff61c5fbf2c1fcd6204d3bdf6dd77e1fc38955aac3ae8d3ab90570bb6d

Request headers

Referer
https://cdn.groupme.quest/sweep/survey/?project=GroupMe&color=2cacf0&prize=iPhone%2015%20PRO&lprice=$1200&nprice=$1&color=2cacf0&t6=Unknown&uclick=ghzwpm&uclickhash=ghzwpm-ghzwgm-fe-0-fe-7s6o-7sdz-958889
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Tue, 06 Aug 2024 00:57:26 GMT
cf-cache-status
MISS
last-modified
Sun, 25 Feb 2024 05:50:10 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"65dad512-af"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FswpiCDf2GHRHQuXPyDV9W2YNO5NaUbrNPi6iq%2FlXcXsynwuQ%2FdihKaH0ycOvJtgI3Rj%2FmEYoLG6XyIlBt7hvg08VnznHWO5f0kbxDjR%2BjCFfREgzLPdnqgRxb%2BhaAGHFQ7fY9n6A81HB4wS8cYFlg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
8aeb12a19b003675-FRA
alt-svc
h3=":443"; ma=86400
content-length
175

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
cdn.funredir.com
URL
https://cdn.funredir.com/dating/18/?uclick=ghzwpm&uclickhash=ghzwpm-ghzwus-q5-0-qd-qd8n-lpfe-d9d69a
Domain
api.trkclk8.space
URL
https://api.trkclk8.space/?method=check&cid=Unknown

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Cloudflare (Online)

27 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| getURLParameter function| getParam string| trk number| startTime function| getTracker function| toOffer function| getOfferLink object| _sended function| progress function| format_number function| loginCheck function| send function| backbutton function| setLoc function| autoredirect function| showAlert function| request function| sound function| getElement function| setValue function| subscribe function| getProfile function| exitpop string| url object| loc object| params number| t

3 Cookies

Domain/Path Name / Value
trk.trkclk8.space/ Name: uclick
Value: ghzwpm
.claim.groupme.quest/ Name: __cf_mw_byp
Value: 5ow9.wWE3SohMMd._xC7pdwvsFwirmUpoUxKJSLVStA-1722905840-0.0.1.1-/
trk.trkclk8.space/ Name: uclickhash
Value: ghzwpm-ghzwgm-fe-0-fe-7s6o-7sdz-958889

2 Console Messages

Source Level URL
Text
javascript error URL: https://cdn.groupme.quest/sweep/survey/?project=GroupMe&color=2cacf0&prize=iPhone%2015%20PRO&lprice=$1200&nprice=$1&color=2cacf0&t6=Unknown&uclick=ghzwpm&uclickhash=ghzwpm-ghzwgm-fe-0-fe-7s6o-7sdz-958889#
Message:
Access to XMLHttpRequest at 'https://api.trkclk8.space/?method=check&cid=Unknown' from origin 'https://cdn.groupme.quest' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://api.trkclk8.space/?method=check&cid=Unknown
Message:
Failed to load resource: net::ERR_FAILED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Frame-Options SAMEORIGIN