urlscan.io logo urlscan.io
SecurityTrails logo

support-eu.lionnets.com Open in urlscan Pro
34.249.147.4  Public Scan

Go To Rescan Add Verdict Report
URL: https://support-eu.lionnets.com/registration.php?id=6368bb046414e529728b6d7b&tid=default
Submission: On February 10 via automatic, source openphish — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 6 HTTP transactions. The main IP is 34.249.147.4, located in Dublin, Ireland and belongs to . The main domain is support-eu.lionnets.com.
TLS certificate: Issued by Amazon RSA 2048 M03 on September 3rd 2023. Valid for: a year.
This is the only time support-eu.lionnets.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 34.249.147.4 ()
1 2a00:1450:400... 15169 (GOOGLE)
1 2600:9000:249... 16509 (AMAZON-02)
2 2606:4700:10:... 13335 (CLOUDFLAR...)
6 4
Apex Domain
Subdomains		 Transfer
2 cymulate.com
app.cymulate.com — Cisco Umbrella Rank: 239239
287 B
2 lionnets.com
support-eu.lionnets.com
62 KB
1 unlayer.com
assets.unlayer.com — Cisco Umbrella Rank: 55468
22 KB
1 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 366
30 KB
6 4
Domain Requested by
2 app.cymulate.com support-eu.lionnets.com
2 support-eu.lionnets.com support-eu.lionnets.com
1 assets.unlayer.com support-eu.lionnets.com
1 ajax.googleapis.com support-eu.lionnets.com
6 4

This site contains no links.

Subject Issuer Validity Valid
lionnets.com
Amazon RSA 2048 M03		 2023-09-03 -
2024-10-01		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2024-01-09 -
2024-04-02		 3 months crt.sh
assets.unlayer.com
Amazon RSA 2048 M02		 2023-04-22 -
2024-05-21		 a year crt.sh
cymulate.com
GTS CA 1P5		 2024-01-23 -
2024-04-22		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://support-eu.lionnets.com/registration.php?id=6368bb046414e529728b6d7b&tid=default
Frame ID: 0F90692BBDE278E9E9E810925957AAFD
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

6
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

114 kB
Transfer

167 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request registration.php
support-eu.lionnets.com/ 		8 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://support-eu.lionnets.com/registration.php?id=6368bb046414e529728b6d7b&tid=default
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.249.147.4 Dublin, Ireland, ASN (),
Reverse DNS
ec2-34-249-147-4.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
710edeff66662e8bbab4724b777e0ad15314ad5eb49afa8ee4ac60a6f15d8164
Security Headers
Name Value
Content-Security-Policy default-src *; style-src 'self' http://* 'unsafe-inline'; script-src 'self' http://* 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-origin
*
content-length
7852
content-security-policy
default-src *; style-src 'self' http://* 'unsafe-inline'; script-src 'self' http://* 'unsafe-inline' 'unsafe-eval'
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
unsafe-none
cross-origin-opener-policy
same-origin
cross-origin-resource-policy
same-origin
date
Sat, 10 Feb 2024 12:21:20 GMT
etag
W/"1eac-/ODQET7YnoKF55OxqBBb13HZY5M"
origin-agent-cluster
?1
referrer-policy
no-referrer
strict-transport-security
max-age=15552000; includeSubDomains
x-content-type-options
nosniff
x-cym
true
x-dns-prefetch-control
off
x-download-options
noopen
x-frame-options
SAMEORIGIN
x-permitted-cross-domain-policies
none
x-xss-protection
0
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js
Requested by
Host: support-eu.lionnets.com
URL: https://support-eu.lionnets.com/registration.php?id=6368bb046414e529728b6d7b&tid=default
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date
Sat, 10 Feb 2024 02:17:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
36257
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
30399
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 09 Feb 2025 02:17:03 GMT
plugindetect.js
support-eu.lionnets.com/ 		53 KB
53 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://support-eu.lionnets.com/plugindetect.js
Requested by
Host: support-eu.lionnets.com
URL: https://support-eu.lionnets.com/registration.php?id=6368bb046414e529728b6d7b&tid=default
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.249.147.4 Dublin, Ireland, ASN (),
Reverse DNS
ec2-34-249-147-4.eu-west-1.compute.amazonaws.com
Software
/ Express
Resource Hash
9348face47feceea53c59d2d675efbbfd417be6d1566c64b95b043442971a980

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date
Sat, 10 Feb 2024 12:21:20 GMT
last-modified
Mon, 22 Jan 2024 15:51:44 GMT
x-powered-by
Express
etag
W/"d438-18d31ded680"
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=0
accept-ranges
bytes
content-length
54328
1664879340447-Logo%20Santander.png
assets.unlayer.com/projects/2690/ 		22 KB
22 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.unlayer.com/projects/2690/1664879340447-Logo%20Santander.png
Requested by
Host: support-eu.lionnets.com
URL: https://support-eu.lionnets.com/registration.php?id=6368bb046414e529728b6d7b&tid=default
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2491:6600:1e:5470:880:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e4dbc5382b07c99174d30ffe5970990970d88b412aec7fc8c2ea8722662f276b

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date
Sat, 10 Feb 2024 12:00:22 GMT
via
1.1 62e7b24ca032b612bb93fa7f3437469c.cloudfront.net (CloudFront)
last-modified
Tue, 04 Oct 2022 10:29:01 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P7
age
1259
etag
"b216736f3bcc31e71877446b3dc81894"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
image/png
accept-ranges
bytes
content-length
22230
x-amz-cf-id
2Uz2z4oyZEcrlCAsgne198WL_xExcJFo4KW2Izqm4MoBN0K1RGp_HQ==
6368bb046414e529728b6d7b
app.cymulate.com/api/phishing/clicked/ 		0
287 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://app.cymulate.com/api/phishing/clicked/6368bb046414e529728b6d7b
Requested by
Host: support-eu.lionnets.com
URL: https://support-eu.lionnets.com/registration.php?id=6368bb046414e529728b6d7b&tid=default
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:ddf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1

Request headers

Referer
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
Content-Type
application/json;charset=UTF-8

Response headers

date
Sat, 10 Feb 2024 12:21:21 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
via
1.1 33febf2d58aeb0618cba096d54cae018.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
none
x-amz-cf-pop
FRA56-P3
cross-origin-embedder-policy
require-corp
x-dns-prefetch-control
off
x-cache
Miss from cloudfront
content-encoding
br
x-xss-protection
1
x-cym
true
referrer-policy
no-referrer
server
cloudflare
cross-origin-opener-policy
same-origin
x-download-options
noopen
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
text/html; charset=utf-8
access-control-allow-origin
*
origin-agent-cluster
?1
access-control-allow-credentials
true
cf-ray
85344fb6a9335d51-FRA
x-amz-cf-id
28UZodME7BAVn7YuIxqxThd2dwo1LYmS7qNPHVaJGP9OqrbIhWJFVg==
6368bb046414e529728b6d7b
app.cymulate.com/api/phishing/clicked/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://app.cymulate.com/api/phishing/clicked/6368bb046414e529728b6d7b
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:ddf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://support-eu.lionnets.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Origin,X-Requested-With,Content-Type,Accept,Authorization,Set-Cookie
access-control-allow-methods
GET,HEAD,PUT,PATCH,POST,DELETE
access-control-allow-origin
*
cf-cache-status
DYNAMIC
cf-ray
85344fb5d80b5d51-FRA
cross-origin-embedder-policy
require-corp
cross-origin-opener-policy
same-origin
date
Sat, 10 Feb 2024 12:21:21 GMT
origin-agent-cluster
?1
referrer-policy
no-referrer
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 33febf2d58aeb0618cba096d54cae018.cloudfront.net (CloudFront)
x-amz-cf-id
PBrdlJWCxNdXwvk8872FssO5DNsoO_PT72gsP9-8-VW96xHrAS2aDg==
x-amz-cf-pop
FRA56-P3
x-cache
Miss from cloudfront
x-content-type-options
nosniff
x-dns-prefetch-control
off
x-download-options
noopen
x-frame-options
SAMEORIGIN
x-permitted-cross-domain-policies
none
x-xss-protection
1

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery object| PluginDetect function| send object| plugins string| plugin object| xhttp

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src *; style-src 'self' http://* 'unsafe-inline'; script-src 'self' http://* 'unsafe-inline' 'unsafe-eval'
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0