sugarurl.com Open in urlscan Pro
172.67.163.188 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://rangkiang.agamkab.go.id/file/data/?id=daftar+olxtoto
Effective URL:
https://sugarurl.com/cdn-cgi/phish-bypass?atok=DuXJoHaVf7DGnhYjH3mQqm1yFmRlA58Z3Uyaeeuyod0-1728805520-0.0.1.1-%2Fgass...
Submission Tags: @phish_report
Submission: On October 13 via api (October 13th 2024, 7:45:25 am UTC) from FI — Scanned from FI

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 5 domains to perform 10 HTTP transactions. The main IP is 172.67.163.188, located in United States and belongs to CLOUDFLARENET, US. The main domain is sugarurl.com.
TLS certificate: Issued by WE1 on September 11th 2024. Valid for: 3 months.

This is the only time sugarurl.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Cloudflare (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	220.247.174.179 220.247.174.179	9341 (ICONPLN-I...) (ICONPLN-ID-AP-ISP PT INDONESIA COMNETS PLUS)
2	2620:0:890::100 2620:0:890::100	54113 (FASTLY) (FASTLY)
1	2a06:98c1:58::eb 2a06:98c1:58::eb	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	162.0.235.245 162.0.235.245	22612 (NAMECHEAP...) (NAMECHEAP-NET)
5	2606:4700:303... 2606:4700:3035::ac43:a3bc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	172.67.163.188 172.67.163.188	13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	4

1 220.247.174.179 (Indonesia) 1 redirects

ASN9341 (ICONPLN-ID-AP-ISP PT INDONESIA COMNETS PLUS, ID)
PTR: mailgw.agamkab.go.id

rangkiang.agamkab.go.id	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:0:890::100 (United States)

ASN54113 (FASTLY, US)

redirect98078.web.app	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a06:98c1:58::eb (United States)

ASN13335 (CLOUDFLARENET, US)

pub-071ea67114a54cc3a1d68875afee380f.r2.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.0.235.245 (United States) 1 redirects

ASN22612 (NAMECHEAP-NET, US)
PTR: premium160-5.web-hosting.com

mrtampan.lol	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700:3035::ac43:a3bc (United States)

ASN13335 (CLOUDFLARENET, US)

sugarurl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.67.163.188 (United States)

ASN13335 (CLOUDFLARENET, US)

sugarurl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	sugarurl.com sugarurl.com	22 KB
2	web.app redirect98078.web.app	2 KB
1	mrtampan.lol 1 redirects mrtampan.lol	220 B
1	r2.dev pub-071ea67114a54cc3a1d68875afee380f.r2.dev	365 KB
1	agamkab.go.id 1 redirects rangkiang.agamkab.go.id	471 B
10	5

	Domain	Requested by
7	sugarurl.com	sugarurl.com
2	redirect98078.web.app
1	mrtampan.lol	1 redirects
1	pub-071ea67114a54cc3a1d68875afee380f.r2.dev	redirect98078.web.app
1	rangkiang.agamkab.go.id	1 redirects
10	5

This site contains no links.

Subject Issuer	Validity	Valid
web.app WR4	`2024-09-25` - `2024-12-24`	3 months	crt.sh
*.r2.dev E5	`2024-09-29` - `2024-12-28`	3 months	crt.sh
sugarurl.com WE1	`2024-09-11` - `2024-12-10`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://sugarurl.com/cdn-cgi/phish-bypass?atok=DuXJoHaVf7DGnhYjH3mQqm1yFmRlA58Z3Uyaeeuyod0-1728805520-0.0.1.1-%2Fgassboss
Frame ID: EC537220F6C3BA7F44B3B0064DDCD762
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

403 Forbidden

Page URL History Show full URLs

https://rangkiang.agamkab.go.id/file/data/?id=daftar+olxtoto HTTP 301
https://redirect98078.web.app/?id=daftar+olxtoto Page URL
https://mrtampan.lol/ HTTP 302
https://sugarurl.com/gassboss Page URL
https://sugarurl.com/cdn-cgi/phish-bypass?atok=DuXJoHaVf7DGnhYjH3mQqm1yFmRlA58Z3Uyaeeuyod0-172880... Page URL

Page Statistics

10
Requests

100 %
HTTPS

50 %
IPv6

5
Domains

5
Subdomains

4
IPs

2
Countries

390 kB
Transfer

417 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://rangkiang.agamkab.go.id/file/data/?id=daftar+olxtoto HTTP 301
https://redirect98078.web.app/?id=daftar+olxtoto Page URL
https://mrtampan.lol/ HTTP 302
https://sugarurl.com/gassboss Page URL
https://sugarurl.com/cdn-cgi/phish-bypass?atok=DuXJoHaVf7DGnhYjH3mQqm1yFmRlA58Z3Uyaeeuyod0-1728805520-0.0.1.1-%2Fgassboss Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://rangkiang.agamkab.go.id/file/data/?id=daftar+olxtoto HTTP 301
https://redirect98078.web.app/?id=daftar+olxtoto

Request Chain 3

https://mrtampan.lol/ HTTP 302
https://sugarurl.com/gassboss

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

/ Show response
redirect98078.web.app/
Redirect Chain

https://rangkiang.agamkab.go.id/file/data/?id=daftar+olxtoto
https://redirect98078.web.app/?id=daftar+olxtoto

2 KB
1 KB

125ms
32ms

Document
text/html

2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://redirect98078.web.app/?id=daftar+olxtoto

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

667024a58be9dbc38a0d2af8329a611693a6c3bd2f5871186b9bd8ab00ebb277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
cache-control: max-age=3600
content-encoding: br
content-length: 868
content-type: text/html; charset=utf-8
date: Sun, 13 Oct 2024 07:45:17 GMT
etag: "32b3e8665a85aee1faec82d5813e29243739ecc2c6ff9202a27a9894f1675e70-br"
last-modified: Thu, 03 Oct 2024 21:36:53 GMT
strict-transport-security: max-age=31556926; includeSubDomains; preload
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
x-cache-hits: 0
x-served-by: cache-hel1410031-HEL
x-timer: S1728805518.769512,VS0,VE1

Redirect headers

content-length: 345
content-type: text/html; charset=iso-8859-1
date: Sun, 13 Oct 2024 07:45:17 GMT
location: https://redirect98078.web.app/?id=daftar+olxtoto
server: nginx

GET
H/1.1 200
OK joker-removebg-preview.png
pub-071ea67114a54cc3a1d68875afee380f.r2.dev/ 365 KB
365 KB 485ms
399ms Image
image/png 2a06:98c1:58::eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pub-071ea67114a54cc3a1d68875afee380f.r2.dev/joker-removebg-preview.png
Requested by: Host: redirect98078.web.app
URL: https://redirect98078.web.app/?id=daftar+olxtoto
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:58::eb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cbffb29748ab8c2e2745bf9263fd2a1696aab3c1854b841b6ce6068f0b06cec5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://redirect98078.web.app/

Response headers

ETag: "9bb2af761e490d0c5292ea618cb92221"
Connection: keep-alive
CF-RAY: 8d1db596ea078d85-HEL
Accept-Ranges: bytes
Content-Length: 373764
Date: Sun, 13 Oct 2024 07:45:18 GMT
Content-Type: image/png
Last-Modified: Sat, 06 Jul 2024 05:50:26 GMT
Vary: Accept-Encoding
Server: cloudflare

GET
H2 404 favicon.ico
redirect98078.web.app/ 2 KB
993 B 32ms
31ms Other
text/html 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://redirect98078.web.app/favicon.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

b77b97fe780d35d18248abd1d2f42f444afbabe43f6abcd8fa8ebb3d47825eee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://redirect98078.web.app/?id=daftar+olxtoto

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
cache-control: max-age=3600
content-encoding: gzip
etag: "762bf484ba67404bd1a3b181546ea28d60dfddf18e9dd4795d8d25bcf3c1a890"
x-timer: S1728805518.413892,VS0,VE1
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT
content-length: 852
date: Sun, 13 Oct 2024 07:45:18 GMT
content-type: text/html; charset=utf-8
last-modified: Thu, 03 Oct 2024 21:36:53 GMT
x-served-by: cache-hel1410031-HEL
x-cache-hits: 1
vary: x-fh-requested-host, accept-encoding

GET
H2

200

gassboss Show response
sugarurl.com/
Redirect Chain

https://mrtampan.lol/
https://sugarurl.com/gassboss

4 KB
2 KB

166ms
49ms

Document
text/html

2606:4700:3035::ac43:a3bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sugarurl.com/gassboss

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3035::ac43:a3bc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

204351c376a241976a0a22a53b86a8fcf2a6c1fd12d6e257b0ce89d490ab4b9e

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://redirect98078.web.app/?id=daftar+olxtoto
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cf-ray: 8d1db5a54ac0a8a2-RIX
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Sun, 13 Oct 2024 07:45:20 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ulBiwDlFdcRFnlEYr1REaRrdIfbY2Tvn51XoJfJPd%2BKe%2FqbsR13Z694Y%2Bj1zUdn45dAwncQ4xqIEQh024v4GPbxo0sGs3kAYzDjn1m6iX9GJW288%2FkfFmBMvJ1OKLc2VcsHa1fU47HxR89k%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN

Redirect headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-length: 0
content-type: text/html; charset=UTF-8
date: Sun, 13 Oct 2024 07:45:19 GMT
location: https://sugarurl.com/gassboss
server: LiteSpeed
x-powered-by: PHP/8.0.30
x-turbo-charged-by: LiteSpeed

GET
H2 403 speculation
sugarurl.com/cdn-cgi/ 0
0 49ms
48ms Other
text/html 2606:4700:3035::ac43:a3bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sugarurl.com/cdn-cgi/speculation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3035::ac43:a3bc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://sugarurl.com
Referer: https://sugarurl.com/gassboss

Response headers

content-encoding: zstd
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=k2LF0YPw53gFpCE22%2FZOwbXpReqVa8IpQXvymFRNQe%2FIZfTLDYHiy29xSW2%2BbXBgTFLIiPfCoZoVYm9B8i3WXEJOubIXhZJWLIkySHI7amrFMk6BOiz%2BVrGxLXRuORH2upFRRxGl3wbu%2F0E%3D"}],"group":"cf-nel","max_age":604800}
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
expires: Thu, 01 Jan 1970 00:00:01 GMT
alt-svc: h3=":443"; ma=86400
x-content-options: nosniff
date: Sun, 13 Oct 2024 07:45:20 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: 045G3XJubbbUlAQvWHyZz6ULxuiVB6BFzCIjr7hE34D2uDE9yV8JRczEpXTi8USw6T4UE/GQKHl48Jqi5TbvsR+STzPO/aoTN+qSDa1wlIziS5XNNNGx4LBTW+fnXufVoOeKyJwvlo+esICALOdykA==$C9Jk3/emsXQWsth/eNrgZw==
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
speculation-rules: "/cdn-cgi/speculation"
cross-origin-resource-policy: same-origin
referrer-policy: same-origin
cf-ray: 8d1db5a5ab0ba8a2-RIX
cross-origin-embedder-policy: require-corp
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
origin-agent-cluster: ?1
server: cloudflare

GET
H2 200 cf.errors.css
sugarurl.com/cdn-cgi/styles/ 23 KB
5 KB 46ms
46ms Stylesheet
text/css 2606:4700:3035::ac43:a3bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sugarurl.com/cdn-cgi/styles/cf.errors.css

Requested by

Host: sugarurl.com
URL: https://sugarurl.com/gassboss

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3035::ac43:a3bc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://sugarurl.com/gassboss

Response headers

vary: Accept-Encoding
cache-control: max-age=7200, public
content-encoding: gzip
etag: W/"67055fb5-5df3"
x-content-type-options: nosniff
cf-ray: 8d1db5a5bb0da8a2-RIX
expires: Sun, 13 Oct 2024 09:45:20 GMT
date: Sun, 13 Oct 2024 07:45:20 GMT
content-type: text/css
last-modified: Tue, 08 Oct 2024 16:37:09 GMT
server: cloudflare
x-frame-options: DENY

GET
H2 200 icon-exclamation.png
sugarurl.com/cdn-cgi/images/ 452 B
541 B 45ms
44ms Image
image/png 2606:4700:3035::ac43:a3bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sugarurl.com/cdn-cgi/images/icon-exclamation.png?1376755637

Requested by

Host: sugarurl.com
URL: https://sugarurl.com/cdn-cgi/styles/cf.errors.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3035::ac43:a3bc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://sugarurl.com/cdn-cgi/styles/cf.errors.css

Response headers

vary: Accept-Encoding
cache-control: max-age=7200, public
etag: "67055fb5-1c4"
x-content-type-options: nosniff
cf-ray: 8d1db5a60b52a8a2-RIX
expires: Sun, 13 Oct 2024 09:45:20 GMT
accept-ranges: bytes
content-length: 452
date: Sun, 13 Oct 2024 07:45:20 GMT
content-type: image/png
last-modified: Tue, 08 Oct 2024 16:37:09 GMT
server: cloudflare
x-frame-options: DENY

GET
H2 403 favicon.ico
sugarurl.com/ 9 KB
7 KB 50ms
49ms Other
text/html 2606:4700:3035::ac43:a3bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sugarurl.com/favicon.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3035::ac43:a3bc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

74ec30f1e76ed98f874d48df42833923d8abc5d737da6275664ff4bf88900c4e

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://sugarurl.com/gassboss

Response headers

content-encoding: zstd
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wFpba1DNWchYnKb%2FMKymK3fwNynlzrA%2BQZbSBa3WgcqhekbFMJ0mzfrmAmgME4x%2FKWkpuZ%2BeEG9v7e8hAdGEH8uDYjxT%2B02whcqwUyV%2BpuwnTMZIxLjggJci3SODNris0I1DJ8YAJikRItI%3D"}],"group":"cf-nel","max_age":604800}
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
expires: Thu, 01 Jan 1970 00:00:01 GMT
alt-svc: h3=":443"; ma=86400
x-content-options: nosniff
date: Sun, 13 Oct 2024 07:45:20 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: cYzEn7yHQS3tnQ8YjrKL3vnhYrsrqtovm4ixLhbo5SasJHx3MsuNhJsgiRSsZZotD9Aay28FT6dnTzYIQjYcqXMXDv1eeZZNC5FFELveCFjg4lZbkQPM2+eil2VgPmB14Bvsp6oaVnc+VF4e+be/0w==$LMYBEuzkgGGWMlzWjpBreA==
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
speculation-rules: "/cdn-cgi/speculation"
cross-origin-resource-policy: same-origin
referrer-policy: same-origin
cf-ray: 8d1db5a64b91a8a2-RIX
cross-origin-embedder-policy: require-corp
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
origin-agent-cluster: ?1
server: cloudflare

GET
H3 403 Primary Request phish-bypass Show response
sugarurl.com/cdn-cgi/ 553 B
293 B 74ms
73ms Document
text/html 172.67.163.188
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sugarurl.com/cdn-cgi/phish-bypass?atok=DuXJoHaVf7DGnhYjH3mQqm1yFmRlA58Z3Uyaeeuyod0-1728805520-0.0.1.1-%2Fgassboss

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.163.188 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

982b986bb578e137f062099427a8caec3c501c84a9e4b22369ebd2badec42fe7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://sugarurl.com/gassboss
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cf-ray: 8d1db5accab15b90-VIE
content-encoding: gzip
content-type: text/html
date: Sun, 13 Oct 2024 07:45:21 GMT
server: cloudflare
x-content-type-options: nosniff
x-frame-options: DENY

GET
H3 403 favicon.ico
sugarurl.com/ 9 KB
8 KB 81ms
80ms Other
text/html 172.67.163.188
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sugarurl.com/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.163.188 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ea528b55fdebce05a2b4be9bec4f25dd938e20bbbc2088ffb147ef5e59fd3a89

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://sugarurl.com/cdn-cgi/phish-bypass?atok=DuXJoHaVf7DGnhYjH3mQqm1yFmRlA58Z3Uyaeeuyod0-1728805520-0.0.1.1-%2Fgassboss

Response headers

content-encoding: zstd
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cml54B%2BLajnN8DIYkq58nut2dt%2BsvvHgmVHt%2F7bzRyKH1hPnHjhDO4OBQE%2FUwS5mD83mqNZ19D%2FOJL%2FIWokbHKN2%2Fhz%2BqtjgGaM1g9vABq1zCwJGGfzwOH4QNYMZRQY%3D"}],"group":"cf-nel","max_age":604800}
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
expires: Thu, 01 Jan 1970 00:00:01 GMT
alt-svc: h3=":443"; ma=86400
x-content-options: nosniff
date: Sun, 13 Oct 2024 07:45:21 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: iwnlbeI2tZlYtpmVAGRc+Bb+3zhIjTBZN4AJSsXvbKIe/YvWZEFAEJbZ4+OckVI7FQaDVAeVwOM4JOjDdx6GCZb2wVuuSDnHpznlANXbVii71z5RmJMK2ILbhAxZYQJnhXRhC2ogtE2o9rT25EFs5g==$dndYWavrVbaTLA4DgDWHYA==
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
speculation-rules: "/cdn-cgi/speculation"
cross-origin-resource-policy: same-origin
referrer-policy: same-origin
cf-ray: 8d1db5ad5b9f5b90-VIE
cross-origin-embedder-policy: require-corp
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
origin-agent-cluster: ?1
server: cloudflare

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Cloudflare (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://redirect98078.web.app/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://sugarurl.com/cdn-cgi/speculation Message: Failed to load resource: the server responded with a status of 403 ()
other	warning	URL: https://sugarurl.com/gassboss Message: Load failed or canceled (net::ERR_ABORTED; HTTP status 403) for rule set requested from "https://sugarurl.com/cdn-cgi/speculation" found in Speculation-Rules header.
network	error	URL: https://sugarurl.com/favicon.ico Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://sugarurl.com/cdn-cgi/phish-bypass?atok=DuXJoHaVf7DGnhYjH3mQqm1yFmRlA58Z3Uyaeeuyod0-1728805520-0.0.1.1-%2Fgassboss Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://sugarurl.com/favicon.ico Message: Failed to load resource: the server responded with a status of 403 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

mrtampan.lol
pub-071ea67114a54cc3a1d68875afee380f.r2.dev
rangkiang.agamkab.go.id
redirect98078.web.app
sugarurl.com
162.0.235.245
172.67.163.188
220.247.174.179
2606:4700:3035::ac43:a3bc
2620:0:890::100
2a06:98c1:58::eb
204351c376a241976a0a22a53b86a8fcf2a6c1fd12d6e257b0ce89d490ab4b9e
667024a58be9dbc38a0d2af8329a611693a6c3bd2f5871186b9bd8ab00ebb277
74ec30f1e76ed98f874d48df42833923d8abc5d737da6275664ff4bf88900c4e
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
982b986bb578e137f062099427a8caec3c501c84a9e4b22369ebd2badec42fe7
b77b97fe780d35d18248abd1d2f42f444afbabe43f6abcd8fa8ebb3d47825eee
cbffb29748ab8c2e2745bf9263fd2a1696aab3c1854b841b6ce6068f0b06cec5
ea528b55fdebce05a2b4be9bec4f25dd938e20bbbc2088ffb147ef5e59fd3a89
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

sugarurl.com Open in urlscan Pro 172.67.163.188 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

10 Requests

100 %HTTPS

50 %IPv6

5 Domains

5 Subdomains

4 IPs

2 Countries

390 kBTransfer

417 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

6 Console Messages

Security Headers

Indicators

sugarurl.com Open in urlscan Pro
172.67.163.188 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

50 %
IPv6

5
Domains

5
Subdomains

4
IPs

2
Countries

390 kB
Transfer

417 kB
Size

0
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!