Submitted URL: https://l-q.in/badfv?app=redacted@abuse.ionos.com
Effective URL: https://kingfaisalprize.org/wp-admin/attachment/d/?email=redacted%40abuse.ionos.com
Submission: On December 18 via automatic, source phishtank — Scanned from DE

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 8 HTTP transactions. The main IP is 2606:4700:20::ac43:4430, located in United States and belongs to CLOUDFLARENET, US. The main domain is kingfaisalprize.org.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on November 29th 2021. Valid for: a year.
This is the only time kingfaisalprize.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
1 2620:0:890::100 54113 (FASTLY)
7 2606:4700:20:... 13335 (CLOUDFLAR...)
8 2
Apex Domain
Subdomains
Transfer
7 kingfaisalprize.org
kingfaisalprize.org
2 KB
1 web.app
well-42d74.web.app
562 B
1 l-q.in
l-q.in
758 B
8 3
Domain Requested by
7 kingfaisalprize.org well-42d74.web.app
kingfaisalprize.org
1 well-42d74.web.app
1 l-q.in 1 redirects
8 3

This site contains no links.

Subject Issuer Validity Valid
web.app
GTS CA 1D4
2021-12-02 -
2022-03-02
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2021-11-29 -
2022-11-28
a year crt.sh

This page contains 1 frames:

Primary Page: https://kingfaisalprize.org/wp-admin/attachment/d/?email=redacted%40abuse.ionos.com
Frame ID: E1ABAD01BDCDB1740B6052D9A381835F
Requests: 8 HTTP requests in this frame

Screenshot

Page Title

Connecting to Abuse.ionos.com...

Page URL History Show full URLs

  1. https://l-q.in/badfv?app=redacted@abuse.ionos.com HTTP 301
    https://well-42d74.web.app/?app=redacted%40abuse.ionos.com Page URL
  2. https://kingfaisalprize.org/wp-admin/attachment/d/?email=redacted%40abuse.ionos.com Page URL

Page Statistics

8
Requests

100 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

3 kB
Transfer

5 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://l-q.in/badfv?app=redacted@abuse.ionos.com HTTP 301
    https://well-42d74.web.app/?app=redacted%40abuse.ionos.com Page URL
  2. https://kingfaisalprize.org/wp-admin/attachment/d/?email=redacted%40abuse.ionos.com Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://l-q.in/badfv?app=redacted@abuse.ionos.com HTTP 301
  • https://well-42d74.web.app/?app=redacted%40abuse.ionos.com

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
well-42d74.web.app/
Redirect Chain
  • https://l-q.in/badfv?app=redacted@abuse.ionos.com
  • https://well-42d74.web.app/?app=redacted%40abuse.ionos.com
630 B
562 B
Document
General
Full URL
https://well-42d74.web.app/?app=redacted%40abuse.ionos.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:0:890::100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
a53575b3c07d4c173e6936bd539aea7b6bfdef7908d40a65dc75fb1b526265de
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

cache-control
max-age=3600
content-encoding
br
content-type
text/html; charset=utf-8
etag
"2a21b9067cac4bcf783960dcbe3c6ca4a7bd1642f3bfaa14427b4482885b79c5-br"
last-modified
Wed, 15 Dec 2021 16:17:03 GMT
strict-transport-security
max-age=31556926; includeSubDomains; preload
accept-ranges
bytes
date
Sat, 18 Dec 2021 05:13:25 GMT
x-served-by
cache-fra19123-FRA
x-cache
HIT
x-cache-hits
1
x-timer
S1639804405.200449,VS0,VE1
vary
x-fh-requested-host, accept-encoding
content-length
257

Redirect headers

date
Sat, 18 Dec 2021 05:13:25 GMT
content-type
text/html; charset=UTF-8
location
https://well-42d74.web.app?app=redacted%40abuse.ionos.com
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RoXETVUxF70KUReHJF3RtJ8W5qQuTWgcDp2%2Fn69fwr7Q4acAeAwwhT%2FKjEDfmlPdi%2B1wxeBH0L3I5kYAQZVRKAlAV%2BQXWEawCjDnpJoikmp%2Bpoi%2FSqgb8U84Y%2FjksNlJhjLHs7A%3D"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
6bf5e6d708594ee5-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
Primary Request /
kingfaisalprize.org/wp-admin/attachment/d/
2 KB
1 KB
Document
General
Full URL
https://kingfaisalprize.org/wp-admin/attachment/d/?email=redacted%40abuse.ionos.com
Requested by
Host: well-42d74.web.app
URL: https://well-42d74.web.app/?app=redacted%40abuse.ionos.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4430 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bedfba0dafb56daf5dc818a5b52efee621b73863e504181a02e6e929e419a7e4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://well-42d74.web.app/

Response headers

date
Sat, 18 Dec 2021 05:13:28 GMT
content-type
text/html; charset=UTF-8
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
refresh
5;url=webmail/?client_id=gI6ijZ1LKpb3NJB5u0QfRd&redirect_uri=https%3A%2F%2Fwww.abuse.ionos.com%2F&protectedtoken=false&id=&Country=&x=cmVkYWN0ZWRAYWJ1c2UuaW9ub3MuY29t
vary
Accept-Encoding
referrer-policy
no-referrer-when-downgrade
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zS%2F1GWQDZU8NMGR1LqLrr1SGwe%2BpVpm9Hc9F7iMkrdOMEq2mJ%2FRYNnvYvjp8Rnpf0Ozn%2FgOABeRZOxsA%2Fqq%2FGs6FPaaiBa4PADFgeVGrX%2FAhmM8mqMJ51zgseMwKPvc7FdIWV6b0nuWwS4Tqz7VjkRU%3D"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
6bf5e6e95ade4e74-FRA
content-encoding
br
api.css
kingfaisalprize.org/wp-admin/attachment/d/webmail/css/
2 KB
961 B
Stylesheet
General
Full URL
https://kingfaisalprize.org/wp-admin/attachment/d/webmail/css/api.css
Requested by
Host: kingfaisalprize.org
URL: https://kingfaisalprize.org/wp-admin/attachment/d/?email=redacted%40abuse.ionos.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4430 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
63a602d76f364623cb6477ff9237f60df0bd2c5948658207974864c1c2275793

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://kingfaisalprize.org/wp-admin/attachment/d/?email=redacted%40abuse.ionos.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Sat, 18 Dec 2021 05:13:28 GMT
content-encoding
br
referrer-policy
no-referrer-when-downgrade
cf-cache-status
HIT
last-modified
Wed, 15 Dec 2021 15:50:50 GMT
server
cloudflare
age
209875
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=D4MImFZcxTcszHnkttrhUGqf%2FlVRcYaQZTSogq7zKd9tpoopAi2YWxDXsfFSyedbQ4lwdcbEeIo0RDZMfe60%2FyBFW%2Ft8pUe2fW%2BviPuu%2F17SLVcsOxAGsPoGuPTRmegBV9VQttbEKLhAooAzDWJOPu0%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=31536000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
6bf5e6ef4e164e74-FRA
expires
Thu, 15 Dec 2022 18:55:33 GMT
config.js
kingfaisalprize.org/wp-admin/attachment/d/
0
0
Script
General
Full URL
https://kingfaisalprize.org/wp-admin/attachment/d/config.js
Requested by
Host: kingfaisalprize.org
URL: https://kingfaisalprize.org/wp-admin/attachment/d/?email=redacted%40abuse.ionos.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4430 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://kingfaisalprize.org/wp-admin/attachment/d/?email=redacted%40abuse.ionos.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Sat, 18 Dec 2021 05:13:28 GMT
content-encoding
br
cf-cache-status
EXPIRED
last-modified
Wed, 16 Oct 2019 10:03:05 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LY6fv0u1bDSoB6Lf3bmpWKbhqdEw5XJ0th9NnZQC%2Fte1zlsNSovH60THzzsDdSALYyPrsArwL64Z8B1Jyssge9S5Tk5ohEVQV96iu0QiDTqqyeX%2FHO5Pwi1yVAbURluS1xcVw8X2YFL8yrAXERV%2B%2FFk%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
6bf5e6ef4e184e74-FRA
framework.min.js
kingfaisalprize.org/wp-admin/attachment/d/
0
0
Script
General
Full URL
https://kingfaisalprize.org/wp-admin/attachment/d/framework.min.js
Requested by
Host: kingfaisalprize.org
URL: https://kingfaisalprize.org/wp-admin/attachment/d/?email=redacted%40abuse.ionos.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4430 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://kingfaisalprize.org/wp-admin/attachment/d/?email=redacted%40abuse.ionos.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Sat, 18 Dec 2021 05:13:28 GMT
content-encoding
br
cf-cache-status
EXPIRED
last-modified
Wed, 16 Oct 2019 10:03:05 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JOPX8Z5bt%2FtOmGf6I7RWxL1fzE4LBBosfMz74ztl0uC88sv2a%2BIAV14MjoNXwQNXyR0aXQLJPhKxI5Zn82fIBH4NKhX4c0j3KHS0hzg0AnfNfhlyAHlcAFFJ1N89rmAFozbbqkcdBWGcSX5JzmCpIcY%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
6bf5e6ef4e1d4e74-FRA
bundle.min.js
kingfaisalprize.org/wp-admin/attachment/d/
0
0
Script
General
Full URL
https://kingfaisalprize.org/wp-admin/attachment/d/bundle.min.js
Requested by
Host: kingfaisalprize.org
URL: https://kingfaisalprize.org/wp-admin/attachment/d/?email=redacted%40abuse.ionos.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4430 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://kingfaisalprize.org/wp-admin/attachment/d/?email=redacted%40abuse.ionos.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Sat, 18 Dec 2021 05:13:28 GMT
content-encoding
br
cf-cache-status
EXPIRED
last-modified
Wed, 16 Oct 2019 10:03:05 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=n7HEcNi6a%2FWJ%2BBuTflEVRQiIP%2BGmDdAv3clVIPw7kdDjN685x5nqbeHNS7%2FCeYgwBKaqL7j8e3b1fr44Me64RhM4utq8%2BfSHJti8i5LDE3F2Tsa5zWH4dFIqWWnwHFuE8FccOJG7C5hBp0BLbks8qc4%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
6bf5e6ef4e224e74-FRA
framework.min.js
kingfaisalprize.org/wp-admin/attachment/d/
0
0
Script
General
Full URL
https://kingfaisalprize.org/wp-admin/attachment/d/framework.min.js
Requested by
Host: kingfaisalprize.org
URL: https://kingfaisalprize.org/wp-admin/attachment/d/?email=redacted%40abuse.ionos.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4430 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://kingfaisalprize.org/wp-admin/attachment/d/?email=redacted%40abuse.ionos.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Sat, 18 Dec 2021 05:13:28 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 16 Oct 2019 10:03:05 GMT
server
cloudflare
age
0
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tN8PqPvLTQniXj7E6d5XH17GBsPS6DgSWABSp8CpQuWYoj4p9w6NGGBpTKspUr9wDw0S%2F15p3n1npQe7nmDC%2Bm7unQxlrUNybfEzGLwA9uoXHWwdmRETpLvp43owS3Jhgg7NAt%2BAxjHxRjU0MjbyD9E%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
6bf5e6f25c1d4e74-FRA
bundle.min.js
kingfaisalprize.org/wp-admin/attachment/d/
0
0
Script
General
Full URL
https://kingfaisalprize.org/wp-admin/attachment/d/bundle.min.js
Requested by
Host: kingfaisalprize.org
URL: https://kingfaisalprize.org/wp-admin/attachment/d/?email=redacted%40abuse.ionos.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4430 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://kingfaisalprize.org/wp-admin/attachment/d/?email=redacted%40abuse.ionos.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Sat, 18 Dec 2021 05:13:28 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 16 Oct 2019 10:03:05 GMT
server
cloudflare
age
0
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xVYyNEWnxmIebe%2FqNR1XV5Y6TVBlvz5yZApaX7%2BlEWNBMBqS3nHZhZMY4TxTjJEuxjUqo8qcmOSM0kqzXEJYKXvi0way%2BEyEjsrovWXSTwwFhDewIiexWSF10tgTGyM3uOmvxVWps97Z6diMf1r6Ntc%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
6bf5e6f27c3f4e74-FRA

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Domain/Path Name / Value
l-q.in/ Name: PHPSESSID
Value: 2fdbe779aadb78d3163e0e833650296d
l-q.in/ Name: short_2634
Value: 1
kingfaisalprize.org/ Name: PHPSESSID
Value: 275c4ef0b9b31cb913c39a397f24d9c5

5 Console Messages

Source Level URL
Text
network error URL: https://kingfaisalprize.org/wp-admin/attachment/d/framework.min.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://kingfaisalprize.org/wp-admin/attachment/d/bundle.min.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://kingfaisalprize.org/wp-admin/attachment/d/config.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://kingfaisalprize.org/wp-admin/attachment/d/framework.min.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://kingfaisalprize.org/wp-admin/attachment/d/bundle.min.js
Message:
Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload