gotogml.com Open in urlscan Pro
89.43.107.240 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://storage.googleapis.com/yasalamyakfdlfdfdxhfdh/linkokanibadotinaho.html#c37924tZEOC16761639xbIF1Ukj30097KEzK2612000000;
Effective URL:
http://gotogml.com/rd/c37924tZEOC16761639xbIF1Ukj30097KEzK2612000000;
Submission Tags: scam/phishing e-mail links
Submission: On March 26 via api (March 26th 2022, 12:28:37 am UTC) from US — Scanned from NL

Summary HTTP 3 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 3 HTTP transactions. The main IP is 89.43.107.240, located in Frankfurt am Main, Germany and belongs to GHOST, LU. The main domain is gotogml.com.

This is the only time gotogml.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	2a00:1450:400... 2a00:1450:4001:828::2010	15169 (GOOGLE) (GOOGLE)
1 2	89.43.107.240 89.43.107.240	202422 (GHOST) (GHOST)
1	193.124.15.34 193.124.15.34	49392 (ASBAXETN) (ASBAXETN)
3	3

1 2a00:1450:4001:828::2010 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

storage.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 89.43.107.240 (Frankfurt am Main, Germany) 1 redirects

ASN202422 (GHOST, LU)
PTR: deepsoul.xyz

gotogml.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 193.124.15.34 (Czech Republic)

ASN49392 (ASBAXETN, RU)

cloridepink.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	gotogml.com 1 redirects gotogml.com	585 B
1	cloridepink.com cloridepink.com	138 B
1	googleapis.com storage.googleapis.com — Cisco Umbrella Rank: 425	821 B
3	3

	Domain	Requested by
2	gotogml.com	1 redirects storage.googleapis.com
1	cloridepink.com	gotogml.com
1	storage.googleapis.com
3	3

This site contains no links.

Subject Issuer	Validity	Valid
*.storage.googleapis.com GTS CA 1C3	`2022-03-17` - `2022-06-09`	3 months	crt.sh
cloridepink.com R3	`2022-03-15` - `2022-06-13`	3 months	crt.sh

This page contains 1 frames:

Frame: https://cloridepink.com/0/0/0/37aa71d5fb3352f8b063893fe55ee71b/10/2612-37924/16761639-1-30097
Frame ID: 99E6677BE3005E04D3A7B853E4529ADE
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://storage.googleapis.com/yasalamyakfdlfdfdxhfdh/linkokanibadotinaho.html Page URL
http://gotogml.com/rd/c37924tZEOC16761639xbIF1Ukj30097KEzK2612000000; Page URL

Page Statistics

3
Requests

67 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

1 kB
Transfer

0 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://storage.googleapis.com/yasalamyakfdlfdfdxhfdh/linkokanibadotinaho.html Page URL
http://gotogml.com/rd/c37924tZEOC16761639xbIF1Ukj30097KEzK2612000000; Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

http://gotogml.com/track/c37924tZEOC16761639xbIF1Ukj30097KEzK2612000000; HTTP 302
https://cloridepink.com/0/0/0/37aa71d5fb3352f8b063893fe55ee71b/10/2612-37924/16761639-1-30097

3 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	linkokanibadotinaho.html storage.googleapis.com/yasalamyakfdlfdfdxhfdh/	246 B 821 B	82ms 32ms	Document text/html	2a00:1450:4001:828::2010 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://storage.googleapis.com/yasalamyakfdlfdfdxhfdh/linkokanibadotinaho.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2010 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software UploadServer / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Accept-Language nl-NL,nl;q=0.9 Response headers x-guploader-uploadid ADPycdsghquYZyME5rQB04BKnOevDNBLlLffH0I4lpLu7LlNRgrcQxS0q9H2wIlmCARzZpvPECoO7T9n-xQ5rETzNU0 x-goog-generation 1646756084574329 x-goog-metageneration 1 x-goog-stored-content-encoding identity x-goog-stored-content-length 246 x-goog-hash crc32c=cPGJ5g== md5=RXIIvuR/yqoaVdBiW6TFAQ== x-goog-storage-class STANDARD accept-ranges bytes content-length 246 server UploadServer date Sat, 26 Mar 2022 00:28:27 GMT expires Sat, 26 Mar 2022 01:28:27 GMT cache-control public, max-age=3600 age 5 last-modified Tue, 08 Mar 2022 16:14:44 GMT etag "457208bee47fcaaa1a55d0625ba4c501" content-type text/html alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H/1.1	200 OK	Primary Request c37924tZEOC16761639xbIF1Ukj30097KEzK2612000000; gotogml.com/rd/	243 B 360 B	103ms 51ms	Document text/html	89.43.107.240 GHOST
General Check archive.org Show headers Download Go to Full URL http://gotogml.com/rd/c37924tZEOC16761639xbIF1Ukj30097KEzK2612000000; Requested by Host: storage.googleapis.com URL: https://storage.googleapis.com/yasalamyakfdlfdfdxhfdh/linkokanibadotinaho.html Protocol HTTP/1.1 Server 89.43.107.240 Frankfurt am Main, Germany, ASN202422 (GHOST, LU), Reverse DNS deepsoul.xyz Software / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Accept-Language nl-NL,nl;q=0.9 Response headers Content-Type text/html; charset=utf-8 Date Sat, 26 Mar 2022 00:28:32 GMT Content-Length 243
GET H/1.1	403 Forbidden	16761639-1-30097 Show response cloridepink.com/0/0/0/37aa71d5fb3352f8b063893fe55ee71b/10/2612-37924/ Redirect Chain http://gotogml.com/track/c37924tZEOC16761639xbIF1Ukj30097KEzK2612000000; https://cloridepink.com/0/0/0/37aa71d5fb3352f8b063893fe55ee71b/10/2612-37924/16761639-1-30097	0 138 B	1052ms 444ms	Document text/html	193.124.15.34 ASBAXETN
General Check archive.org Show headers Download Go to Full URL https://cloridepink.com/0/0/0/37aa71d5fb3352f8b063893fe55ee71b/10/2612-37924/16761639-1-30097 Requested by Host: gotogml.com URL: http://gotogml.com/rd/c37924tZEOC16761639xbIF1Ukj30097KEzK2612000000; Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 193.124.15.34 , Czech Republic, ASN49392 (ASBAXETN, RU), Reverse DNS Software Apache / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Accept-Language nl-NL,nl;q=0.9 Referer http://gotogml.com/rd/c37924tZEOC16761639xbIF1Ukj30097KEzK2612000000; Response headers date Sat, 26 Mar 2022 00:28:33 GMT content-type text/html; charset=UTF-8 content-length 0 server Apache Redirect headers Content-Type text/html; charset=utf-8 Location https://cloridepink.com/0/0/0/37aa71d5fb3352f8b063893fe55ee71b/10/2612-37924/16761639-1-30097 Date Sat, 26 Mar 2022 00:28:32 GMT Content-Length 116

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://cloridepink.com/0/0/0/37aa71d5fb3352f8b063893fe55ee71b/10/2612-37924/16761639-1-30097 Message: Failed to load resource: the server responded with a status of 403 (Forbidden)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cloridepink.com
gotogml.com
storage.googleapis.com
193.124.15.34
2a00:1450:4001:828::2010
89.43.107.240
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

gotogml.com Open in urlscan Pro 89.43.107.240 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

3 Requests

67 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

1 kBTransfer

0 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

gotogml.com Open in urlscan Pro
89.43.107.240 Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

67 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

1 kB
Transfer

0 kB
Size

0
Cookies

3 HTTP transactions
0 data transactions