Submitted URL: https://fr2.readytocheckline.com/t2kf4F?ds=https://custominvest.vn
Effective URL: https://0.rebrandingstoreblue.com/index.php?p=gztggyrtgi5dcojxha4q&sub1=corsa&sub2=cert&sub3=spz
Submission: On December 13 via api from BE — Scanned from FI

Summary

This website contacted 5 IPs in 2 countries across 2 domains to perform 8 HTTP transactions. The main IP is 2a06:98c1:3121::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is 0.rebrandingstoreblue.com.
TLS certificate: Issued by WE1 on December 10th 2024. Valid for: 3 months.
This is the only time 0.rebrandingstoreblue.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
3 2606:4700:303... 13335 (CLOUDFLAR...)
2 188.114.96.3 13335 (CLOUDFLAR...)
1 172.67.192.6 13335 (CLOUDFLAR...)
2 2a06:98c1:312... 13335 (CLOUDFLAR...)
8 5
Apex Domain
Subdomains
Transfer
4 rebrandingstoreblue.com
rebrandingstoreblue.com
0.rebrandingstoreblue.com
16 KB
4 readytocheckline.com
fr2.readytocheckline.com — Cisco Umbrella Rank: 999589
fr1.readytocheckline.com — Cisco Umbrella Rank: 984314
3 KB
8 2

This site contains no links.

Subject Issuer Validity Valid
readytocheckline.com
WE1
2024-10-16 -
2025-01-14
3 months crt.sh
rebrandingstoreblue.com
WE1
2024-12-10 -
2025-03-10
3 months crt.sh

This page contains 1 frames:

Primary Page: https://0.rebrandingstoreblue.com/index.php?p=gztggyrtgi5dcojxha4q&sub1=corsa&sub2=cert&sub3=spz
Frame ID: 4105795B16C37A2CBF405501587DEF54
Requests: 12 HTTP requests in this frame

Screenshot

Page Title

captcha

Page URL History Show full URLs

  1. https://fr2.readytocheckline.com/t2kf4F?ds=https://custominvest.vn Page URL
  2. https://fr1.readytocheckline.com/RYewtyw Page URL
  3. https://rebrandingstoreblue.com/go/gztggyrtgi5dcojxha4q?sub1=corsa&sub2=cert&sub3=spz Page URL
  4. https://0.rebrandingstoreblue.com/index.php?p=gztggyrtgi5dcojxha4q&sub1=corsa&sub2=cert&sub3=spz Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

8
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

4
Subdomains

5
IPs

2
Countries

20 kB
Transfer

27 kB
Size

6
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://fr2.readytocheckline.com/t2kf4F?ds=https://custominvest.vn Page URL
  2. https://fr1.readytocheckline.com/RYewtyw Page URL
  3. https://rebrandingstoreblue.com/go/gztggyrtgi5dcojxha4q?sub1=corsa&sub2=cert&sub3=spz Page URL
  4. https://0.rebrandingstoreblue.com/index.php?p=gztggyrtgi5dcojxha4q&sub1=corsa&sub2=cert&sub3=spz Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
t2kf4F
fr2.readytocheckline.com/
204 B
1 KB
Document
General
Full URL
https://fr2.readytocheckline.com/t2kf4F?ds=https://custominvest.vn
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::ac43:c006 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
aece6748df5f2ab39527da33a027a62ffcfa56eefb9136d85cd8ad116af4132d

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
cache-control
no-cache, no-store, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
8f19b9777dabb80f-RIX
content-encoding
zstd
content-type
text/html; charset=utf-8
date
Fri, 13 Dec 2024 23:27:22 GMT
expires
Fri, 13 Dec 2024 23:27:22 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xNaHSXLOFMk1S5hA%2Frlow7mW04L9KO8sLQHPIOTH1r%2BuuxdF1liAS%2FRjDAlx4v4s5oRKivvjkB9EVNzn3wf4QS3%2BlHwfEXHm2eCRp9T2OqNNVYzuTeeSJ0pZd19itQ39nkfdCq19oa%2FrlUbtQ6iHIC7ytTHvLgI%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=TCP&rtt=50087&min_rtt=50002&rtt_var=7991&sent=7&recv=11&lost=0&retrans=0&sent_bytes=3994&recv_bytes=2422&delivery_rate=80530&cwnd=253&unsent_bytes=0&cid=5765b0b5531a3000&ts=203&x=0"
vary
Accept-Encoding
RYewtyw
fr1.readytocheckline.com/
249 B
927 B
Document
General
Full URL
https://fr1.readytocheckline.com/RYewtyw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::ac43:c006 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
42659362526389cfd4cbc28f99b1c3b6aed796d6a63793f4306a4be4eb60c87f

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
cache-control
no-cache, no-store, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
8f19b978ede7b80f-RIX
content-encoding
zstd
content-type
text/html; charset=utf-8
date
Fri, 13 Dec 2024 23:27:23 GMT
expires
Fri, 13 Dec 2024 23:27:23 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5blekKHUboi8zVQyIXiR1nnjcXlPDIEKmAe8F0%2FxPG9zf8vEI1R54AoUHNlDqXhkoDzB%2BqhgWNBNUoKcRZAH4Q2ARznPUqgu7Zf1y4BsyHItXryHLtMcoLZeKnYvN3a0BMnjn2kbajiwdfa8xo7F1tTqMsNDxMw%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=TCP&rtt=50055&min_rtt=49887&rtt_var=4548&sent=16&recv=15&lost=0&retrans=0&sent_bytes=5912&recv_bytes=2834&delivery_rate=107777&cwnd=257&unsent_bytes=0&cid=5765b0b5531a3000&ts=424&x=0"
vary
Accept-Encoding
favicon.ico
fr2.readytocheckline.com/
548 B
649 B
Other
General
Full URL
https://fr2.readytocheckline.com/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::ac43:c006 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
zstd
cf-cache-status
EXPIRED
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EqzB%2F%2BS5c9k3bpvo%2BKZuj3ba89pj9xuztOkDFng3SqhydJNH%2Fc5PkDEhg5A%2BIGv03DVbO7U4pcrFwgZcT6LpPrZ7Q%2BzSxGiZPhCDyjcNY74o6Mps0GRBXf3w0swTWLPYPZQ%2BRvFDD4lyMk3e2FPmPaxiUt2ueZ4%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8f19b978dde4b80f-RIX
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=TCP&rtt=50055&min_rtt=49887&rtt_var=4548&sent=13&recv=15&lost=0&retrans=0&sent_bytes=5197&recv_bytes=2834&delivery_rate=107777&cwnd=257&unsent_bytes=0&cid=5765b0b5531a3000&ts=393&x=0"
date
Fri, 13 Dec 2024 23:27:23 GMT
content-type
text/html; charset=utf-8
vary
Accept-Encoding
server
cloudflare
gztggyrtgi5dcojxha4q
rebrandingstoreblue.com/go/
12 KB
8 KB
Document
General
Full URL
https://rebrandingstoreblue.com/go/gztggyrtgi5dcojxha4q?sub1=corsa&sub2=cert&sub3=spz
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
95683c465958e387cf753e83501b7745e3f71a71eaed6d1959f9c91cb05ed7bf

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8f19b97aabc170bb-WAW
content-encoding
zstd
content-type
text/html; charset=UTF-8
date
Fri, 13 Dec 2024 23:27:23 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority
u=0,i
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KA7Rc1uqLp50FcohEQlhtZ4e5XIEAJGE5UJXm8tToj4lVX7dleT2vj19Pr2JIaNfG6bHMTa%2Bgqj47jR6oapJ9UCpPDPAkR69y%2Bu%2B99CcF%2FJXeg93CCEp8tgqczeNUjIjz9800EvQVS3elQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=QUIC&rtt=54989&min_rtt=54838&rtt_var=11693&sent=12&recv=9&lost=0&retrans=0&sent_bytes=4171&recv_bytes=4475&delivery_rate=10613&cwnd=12000&unsent_bytes=0&cid=d7b4bed62fd7a7c6&ts=138&x=1" cfExtPri cfHdrFlush;dur=0
favicon.ico
fr1.readytocheckline.com/
548 B
834 B
Other
General
Full URL
https://fr1.readytocheckline.com/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.192.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
zstd
cf-cache-status
EXPIRED
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IcGPLjLTjFzOkFj0gd9sF4ut%2BIvUW897JqIaDW0Ox10nOWuRC2%2BR1gP2Gf1M7GTSY5HK2SihyAjA%2BZ4GHnpJDFtymaSikf%2BJbc1YV9T4sEmBIGM3DQgbTwvdEArEqWjhvJcHd5r20tQytXs%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8f19b97a2c99ee3a-WAW
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=55146&min_rtt=55075&rtt_var=8835&sent=12&recv=10&lost=0&retrans=0&sent_bytes=4172&recv_bytes=4625&delivery_rate=347&cwnd=12000&unsent_bytes=0&cid=3190d9159f6aaee6&ts=330&x=1", cfExtPri, cfHdrFlush;dur=0
date
Fri, 13 Dec 2024 23:27:23 GMT
content-type
text/html; charset=utf-8
vary
Accept-Encoding
server
cloudflare
priority
u=1,i
truncated
/
748 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a5308b7decd6fc2d5e8438fb037c4a822125135db832c05437d754655ff2fc23

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
favicon.ico
rebrandingstoreblue.com/
0
634 B
Other
General
Full URL
https://rebrandingstoreblue.com/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://rebrandingstoreblue.com/go/gztggyrtgi5dcojxha4q?sub1=corsa&sub2=cert&sub3=spz

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status
HIT
age
4237
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=R6xgXG2l4sUnDyamn5wVuWFhYJHh0zUxL4uCI0Kp4hY874tdRO6IXXu5LrVr3oRJo0xhmVw6emOFQ3jwaNfn3yYycJtw42KZOrVWg%2FmuK3eXyyN4AfAO4XRq6vNfjc2iaNPG7wioxPXIuQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8f19b97b9c5370bb-WAW
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=65267&min_rtt=54838&rtt_var=14450&sent=24&recv=15&lost=0&retrans=0&sent_bytes=13002&recv_bytes=5484&delivery_rate=105001&cwnd=12000&unsent_bytes=0&cid=d7b4bed62fd7a7c6&ts=221&x=1", cfExtPri, cfHdrFlush;dur=0
date
Fri, 13 Dec 2024 23:27:23 GMT
vary
Accept-Encoding
server
cloudflare
priority
u=1,i
Primary Request index.php
0.rebrandingstoreblue.com/
12 KB
8 KB
Document
General
Full URL
https://0.rebrandingstoreblue.com/index.php?p=gztggyrtgi5dcojxha4q&sub1=corsa&sub2=cert&sub3=spz
Requested by
Host: fr2.readytocheckline.com
URL: https://fr2.readytocheckline.com/t2kf4F?ds=https://custominvest.vn
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7b8563297d99128f2c254c9c8a52e8b910b368f3234ec5e1194cb9d6bf586b1b

Request headers

Referer
https://rebrandingstoreblue.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8f19b98729135433-TLL
content-encoding
zstd
content-type
text/html; charset=UTF-8
date
Fri, 13 Dec 2024 23:27:25 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j4IaupdeiNo1jYvHS7SJWbQfMO6T8RMqWLfU3bCQbaTmx9QW07jDhnEWG0%2B8%2B57dortL5%2B%2B08xg5JXRRS27XTDe5KDEevgOXfMt9wyvnPVtGIbFYvzHqkkvyhZ4aePP%2Fo3aiDHOZtSpVIQxAXaTTlen7hosMKz5t"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=TCP&rtt=39502&min_rtt=39334&rtt_var=6437&sent=7&recv=11&lost=0&retrans=0&sent_bytes=4338&recv_bytes=2426&delivery_rate=101338&cwnd=253&unsent_bytes=0&cid=e7b59a3a4d54798d&ts=132&x=0"
truncated
/
748 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a5308b7decd6fc2d5e8438fb037c4a822125135db832c05437d754655ff2fc23

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
truncated
/
378 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6935876b0112bb2bb5aa7e27c0fdf9be86e190d47a0fbff8eb8e67e25d11f68d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
truncated
/
377 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f9077e9ffe52966b3a279d70797b41c4eba4e6d3928471fe755fcc3856ac4b3e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
favicon.ico
0.rebrandingstoreblue.com/
0
434 B
Other
General
Full URL
https://0.rebrandingstoreblue.com/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://0.rebrandingstoreblue.com/index.php?p=gztggyrtgi5dcojxha4q&sub1=corsa&sub2=cert&sub3=spz

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status
EXPIRED
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AbZMZbl%2FjKLEOk1cezujIJBn0gB%2BKXPx44PhxvpdYut1QpCfLSEFHR9MnXM0%2FfmMV00bKumPImiX4MngYdC4Urw%2F9B5emLJABc0fprg070LugsI5fdr1IJY4UHvwOfzTSBTpi8vmI77tl%2B42i4jvB4%2FOBGV2iqcb"}],"group":"cf-nel","max_age":604800}
cf-ray
8f19b98809dc5433-TLL
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=TCP&rtt=39502&min_rtt=39334&rtt_var=1244&sent=24&recv=19&lost=0&retrans=0&sent_bytes=12931&recv_bytes=2843&delivery_rate=405362&cwnd=257&unsent_bytes=0&cid=e7b59a3a4d54798d&ts=253&x=0"
date
Fri, 13 Dec 2024 23:27:25 GMT
vary
Accept-Encoding
server
cloudflare

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| urlB64ToUint8Array

6 Cookies

Domain/Path Name / Value
fr2.readytocheckline.com/ Name: _subid
Value: 1dskv82d20vb
fr2.readytocheckline.com/ Name: 7b22a
Value: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjM0XCI6MTczNDEzMjQ0Mn0sXCJjYW1wYWlnbnNcIjp7XCI0XCI6MTczNDEzMjQ0Mn0sXCJ0aW1lXCI6MTczNDEzMjQ0Mn0ifQ.t4S09g43_e9Av4DEoXG2VqvnN2lBhAaGCyOr5xrn-fI
fr1.readytocheckline.com/ Name: _subid
Value: 1dskv82d20vf
fr1.readytocheckline.com/ Name: 7b22a
Value: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjUyXCI6MTczNDEzMjQ0M30sXCJjYW1wYWlnbnNcIjp7XCI3XCI6MTczNDEzMjQ0M30sXCJ0aW1lXCI6MTczNDEzMjQ0M30ifQ.vQZIOGEdCdm6uMV_DHSY-T81vkkwwi9Xa4n3n0OvWtM
.rebrandingstoreblue.com/ Name: uuid
Value: 506c5cf5-2e11-4b13-848a-6726ae72f08a
.0.rebrandingstoreblue.com/ Name: uuid
Value: 506c5cf5-2e11-4b13-848a-6726ae72f08a

2 Console Messages

Source Level URL
Text
network error URL: https://fr2.readytocheckline.com/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://fr1.readytocheckline.com/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 ()