urlscan.io logo urlscan.io
SecurityTrails logo

l.wl.co Open in urlscan Pro
2a03:2880:f02d:e:face:b00c:0:2  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://bit.ly/3VFZesT?181601
Effective URL: https://l.wl.co/l?u=https://smarturl.it/g9jkyv
Submission Tags: phishing
Submission: On October 21 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 4 countries across 7 domains to perform 4 HTTP transactions. The main IP is 2a03:2880:f02d:e:face:b00c:0:2, located in Frankfurt am Main, Germany and belongs to FACEBOOK, US. The main domain is l.wl.co. The Cisco Umbrella rank of the primary domain is 359789.
TLS certificate: Issued by DigiCert SHA2 High Assurance Server CA on July 30th 2022. Valid for: 3 months.
This is the only time l.wl.co was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 67.199.248.11 396982 (GOOGLE-CL...)
1 1 104.244.42.133 13414 (TWITTER)
3 2a03:2880:f02... 32934 (FACEBOOK)
1 1 54.183.132.164 16509 (AMAZON-02)
1 1 34.243.9.140 16509 (AMAZON-02)
1 1 148.251.234.93 24940 (HETZNER-AS)
1 176.111.49.48 24703 (UN-UKRAIN...)
4 2
1    67.199.248.11 (United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: bit.ly
bit.ly
1    104.244.42.133 (United States)

ASN13414 (TWITTER, US)
t.co
3    2a03:2880:f02d:e:face:b00c:0:2 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
l.wl.co
1    54.183.132.164 (San Jose, United States)

ASN16509 (AMAZON-02, US)
PTR: ow.ly
ow.ly
1    34.243.9.140 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-243-9-140.eu-west-1.compute.amazonaws.com
smarturl.it
1    148.251.234.93 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: iplogger.com
iplis.ru
1    176.111.49.48 (Kyiv, Ukraine)

ASN24703 (UN-UKRAINE-AS Kiev, Ukraine, UA)
PTR: isp29.s-host.net
hinoki.com.ua
Apex Domain
Subdomains		 Transfer
3 wl.co
l.wl.co — Cisco Umbrella Rank: 359789
2 KB
1 hinoki.com.ua
hinoki.com.ua
145 B
1 iplis.ru
iplis.ru
502 B
1 smarturl.it
smarturl.it — Cisco Umbrella Rank: 181891
699 B
1 ow.ly
ow.ly — Cisco Umbrella Rank: 80455
398 B
1 t.co
t.co — Cisco Umbrella Rank: 483
359 B
1 bit.ly
bit.ly — Cisco Umbrella Rank: 4998
227 B
4 7
Domain Requested by
3 l.wl.co l.wl.co
1 hinoki.com.ua l.wl.co
1 iplis.ru 1 redirects
1 smarturl.it 1 redirects
1 ow.ly 1 redirects
1 t.co 1 redirects
1 bit.ly 1 redirects
4 7

This site contains no links.

Subject Issuer Validity Valid
*.wl.co
DigiCert SHA2 High Assurance Server CA		 2022-07-30 -
2022-10-28		 3 months crt.sh
hinoki.com.ua
R3		 2022-09-12 -
2022-12-11		 3 months crt.sh

This page contains 1 frames:

Frame: https://hinoki.com.ua/php/index.php?login
Frame ID: D3CDA112F54406E2C7B9F6172FB4FDCA
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://bit.ly/3VFZesT?181601 HTTP 301
    https://t.co/dAny5QU7hp HTTP 301
    https://l.wl.co/l?u=http://ow.ly/lozt50LfmBC Page URL
  2. http://l.wl.co/l/?u=http%3A%2F%2Fow.ly%2Flozt50LfmBC&e=AT3bOIF4U7efw9v8fCZmpSE-pGB594POM4mO... Page URL
  3. http://ow.ly/lozt50LfmBC HTTP 301
    https://l.wl.co/l?u=https://smarturl.it/g9jkyv Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

4
Requests

75 %
HTTPS

14 %
IPv6

7
Domains

7
Subdomains

2
IPs

4
Countries

2 kB
Transfer

1 kB
Size

7
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://bit.ly/3VFZesT?181601 HTTP 301
    https://t.co/dAny5QU7hp HTTP 301
    https://l.wl.co/l?u=http://ow.ly/lozt50LfmBC Page URL
  2. http://l.wl.co/l/?u=http%3A%2F%2Fow.ly%2Flozt50LfmBC&e=AT3bOIF4U7efw9v8fCZmpSE-pGB594POM4mO0VMCtfFj-6z5NtcXMaeVTIfG7-ZDXDF2M9p8fsGRdsm1imGK77q-KX2Gua4MopM5PnGn369xRBbxcmzQszd_QcIO-E_0Nj1KBMXTJg0 Page URL
  3. http://ow.ly/lozt50LfmBC HTTP 301
    https://l.wl.co/l?u=https://smarturl.it/g9jkyv Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://bit.ly/3VFZesT?181601 HTTP 301
  • https://t.co/dAny5QU7hp HTTP 301
  • https://l.wl.co/l?u=http://ow.ly/lozt50LfmBC
Request Chain 2
  • https://smarturl.it/g9jkyv HTTP 301
  • https://iplis.ru/2tBqn4 HTTP 302
  • https://hinoki.com.ua/php/index.php?login

4 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
l
l.wl.co/
Redirect Chain
  • https://bit.ly/3VFZesT?181601
  • https://t.co/dAny5QU7hp
  • https://l.wl.co/l?u=http://ow.ly/lozt50LfmBC
368 B
889 B 		Document
General
Check archive.org
Download Go to
Full URL
https://l.wl.co/l?u=http://ow.ly/lozt50LfmBC
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:e:face:b00c:0:2 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
private, no-cache, no-store, must-revalidate
content-encoding
br
content-type
text/html; charset="utf-8"
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
rollout
date
Fri, 21 Oct 2022 14:09:55 GMT
document-policy
force-load-at-top
expires
Sat, 01 Jan 2000 00:00:00 GMT
pragma
no-cache
refresh
1;URL=http://l.wl.co/l/?u=http%3A%2F%2Fow.ly%2Flozt50LfmBC&e=AT3bOIF4U7efw9v8fCZmpSE-pGB594POM4mO0VMCtfFj-6z5NtcXMaeVTIfG7-ZDXDF2M9p8fsGRdsm1imGK77q-KX2Gua4MopM5PnGn369xRBbxcmzQszd_QcIO-E_0Nj1KBMXTJg0
vary
Accept-Encoding
x-content-type-options
nosniff
x-fb-debug
BieilQVUuu2gG2TZQeImBEU6NLkEvm+V8gO1yp/mUkmBCySNe8tw3Q3ONLafPYBpiFaIk6iPW8P5sQg6pgKjSg==
x-frame-options
DENY
x-robots-tag
noindex, nofollow
x-xss-protection
0

Redirect headers

cache-control
private,max-age=300
content-length
0
date
Fri, 21 Oct 2022 14:09:54 GMT
expires
Fri, 21 Oct 2022 14:14:55 GMT
location
https://l.wl.co/l?u=http://ow.ly/lozt50LfmBC
perf
7626143928
server
tsa_o
strict-transport-security
max-age=0
vary
Origin
x-connection-hash
6ffedc8225771cc53b8afea482a0a5a893a05560d2f1e0494790359021473a2a
x-response-time
114
x-transaction-id
1b3c063764b94b9c
/
l.wl.co/l/ 		177 B
860 B 		Document
General
Check archive.org
Download Go to
Full URL
http://l.wl.co/l/?u=http%3A%2F%2Fow.ly%2Flozt50LfmBC&e=AT3bOIF4U7efw9v8fCZmpSE-pGB594POM4mO0VMCtfFj-6z5NtcXMaeVTIfG7-ZDXDF2M9p8fsGRdsm1imGK77q-KX2Gua4MopM5PnGn369xRBbxcmzQszd_QcIO-E_0Nj1KBMXTJg0
Requested by
Host: l.wl.co
URL: https://l.wl.co/l?u=http://ow.ly/lozt50LfmBC
Protocol
HTTP/1.1
Server
2a03:2880:f02d:e:face:b00c:0:2 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
accept-language
de-DE,de;q=0.9

Response headers

Alt-Svc
h3=":443"; ma=86400
Cache-Control
private, no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html; charset="utf-8"
Date
Fri, 21 Oct 2022 14:09:55 GMT
Expires
Sat, 01 Jan 2000 00:00:00 GMT
Pragma
no-cache
Refresh
1;URL=http://ow.ly/lozt50LfmBC
Transfer-Encoding
chunked
Vary
Accept-Encoding
X-Content-Type-Options
nosniff
X-FB-Debug
TB4hPG388+XMzzz+h8iA055yvTui0GX2xda1xRvUHNLDuahpJOmlNgbWdRt8zam/RJcrrPsltM9kBuEdW/Czpg==
X-Frame-Options
DENY
X-XSS-Protection
0
cross-origin-resource-policy
rollout
document-policy
force-load-at-top
x-robots-tag
noindex, nofollow
Primary Request l
l.wl.co/
Redirect Chain
  • http://ow.ly/lozt50LfmBC
  • https://l.wl.co/l?u=https://smarturl.it/g9jkyv
179 B
282 B 		Document
General
Check archive.org
Download Go to
Full URL
https://l.wl.co/l?u=https://smarturl.it/g9jkyv
Requested by
Host: l.wl.co
URL: http://l.wl.co/l/?u=http%3A%2F%2Fow.ly%2Flozt50LfmBC&e=AT3bOIF4U7efw9v8fCZmpSE-pGB594POM4mO0VMCtfFj-6z5NtcXMaeVTIfG7-ZDXDF2M9p8fsGRdsm1imGK77q-KX2Gua4MopM5PnGn369xRBbxcmzQszd_QcIO-E_0Nj1KBMXTJg0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:e:face:b00c:0:2 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
http://l.wl.co/l/?u=http%3A%2F%2Fow.ly%2Flozt50LfmBC&e=AT3bOIF4U7efw9v8fCZmpSE-pGB594POM4mO0VMCtfFj-6z5NtcXMaeVTIfG7-ZDXDF2M9p8fsGRdsm1imGK77q-KX2Gua4MopM5PnGn369xRBbxcmzQszd_QcIO-E_0Nj1KBMXTJg0
Upgrade-Insecure-Requests
1
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
private, no-cache, no-store, must-revalidate
content-encoding
br
content-type
text/html; charset="utf-8"
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
rollout
date
Fri, 21 Oct 2022 14:09:55 GMT
document-policy
force-load-at-top
expires
Sat, 01 Jan 2000 00:00:00 GMT
pragma
no-cache
priority
u=3,i
refresh
1;URL=https://smarturl.it/g9jkyv
vary
Accept-Encoding
x-content-type-options
nosniff
x-fb-debug
NiqRT/MJpyKlOPqY66SiZu2oOWbvL3h2GIEx+fRLtmu84QOpocXpYDJOScOtVFZLwb4LKwLQglJAVzQ4j9s4uw==
x-frame-options
DENY
x-robots-tag
noindex, nofollow
x-xss-protection
0

Redirect headers

Connection
close
Content-Length
0
Date
Fri, 21 Oct 2022 14:09:55 GMT
Location
https://l.wl.co/l?u=https://smarturl.it/g9jkyv
Referrer-Policy
origin-when-cross-origin, strict-origin-when-cross-origin
X-Content-Type-Options
nosniff
X-Frame-Options
DENY
X-Permitted-Cross-Domain-Policies
master-only
X-Pool
owly_web
X-XSS-Protection
1; mode=block
index.php
hinoki.com.ua/php/
Redirect Chain
  • https://smarturl.it/g9jkyv
  • https://iplis.ru/2tBqn4
  • https://hinoki.com.ua/php/index.php?login
0
145 B 		Document
General
Check archive.org
Download Go to
Full URL
https://hinoki.com.ua/php/index.php?login
Requested by
Host: l.wl.co
URL: https://l.wl.co/l?u=https://smarturl.it/g9jkyv
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
176.111.49.48 Kyiv, Ukraine, ASN24703 (UN-UKRAINE-AS Kiev, Ukraine, UA),
Reverse DNS
isp29.s-host.net
Software
nginx/1.20.2 / PHP/7.0.33
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://l.wl.co/l?u=https://smarturl.it/g9jkyv
Upgrade-Insecure-Requests
1
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=0, private, no-cache, no-store, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
date
Fri, 21 Oct 2022 14:09:57 GMT
server
nginx/1.20.2
x-powered-by
PHP/7.0.33

Redirect headers

cache-control
no-store, no-cache, must-revalidate
content-security-policy
img-src https: data:; upgrade-insecure-requests
content-type
text/html; charset=UTF-8
date
Fri, 21 Oct 2022 14:09:56 GMT
expires
Fri, 21 Oct 2022 14:09:56 +0000
location
https://hinoki.com.ua/php/index.php?login
server
nginx
strict-transport-security
max-age=604800 max-age=31536000
x-frame-options
SAMEORIGIN

Verdicts & Comments Add Verdict or Comment

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation

7 Cookies

Domain/Path Name / Value
.bit.ly/ Name: _bit
Value: m9le9S-0403ab930f090ce80e-00F
.t.co/ Name: muc
Value: e440f8fe-2ea3-4ca3-ac5c-819f0ec3d0c1
smarturl.it/ Name: AWSALB
Value: aYlqa1yl4KwrNf6Qj9KbY181zAUW2puSU5vijr+GJWMICDLFIJMXo/1oYhWIIMM18ytRTGOO1u7e/cV+VmG8w80eQOtTFYhEMK5QRgjPamOG9bAOKnWhmtYla+DD
smarturl.it/ Name: requester_id
Value: 1583460579962175491
smarturl.it/ Name: last_click_g9jkyv
Value: 1666361396194
iplis.ru/ Name: clhf03028ja
Value: 81.95.5.44
iplis.ru/ Name: 407506801365181740
Value: 3

1 Console Messages

Source Level URL
Text
network error URL: https://hinoki.com.ua/php/index.php?login
Message:
Failed to load resource: the server responded with a status of 403 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bit.ly
hinoki.com.ua
iplis.ru
l.wl.co
ow.ly
smarturl.it
t.co
104.244.42.133
148.251.234.93
176.111.49.48
2a03:2880:f02d:e:face:b00c:0:2
34.243.9.140
54.183.132.164
67.199.248.11
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855