metroblogtoday.com Open in urlscan Pro
2606:4700:3037::ac43:dd16 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://metroblogtoday.com/
Submission Tags: phishingrod
Submission: On August 09 via api (August 9th 2023, 1:19:10 am UTC) from DE — Scanned from DE

Summary HTTP 8 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 2606:4700:3037::ac43:dd16, located in United States and belongs to CLOUDFLARENET, US. The main domain is metroblogtoday.com.
TLS certificate: Issued by E1 on August 5th 2023. Valid for: 3 months.

This is the only time metroblogtoday.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
1 8	2606:4700:303... 2606:4700:3037::ac43:dd16		13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	2

8 2606:4700:3037::ac43:dd16 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

metroblogtoday.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	metroblogtoday.com 1 redirects metroblogtoday.com	27 KB
8	1

	Domain	Requested by
8	metroblogtoday.com	1 redirects metroblogtoday.com
8	1

This site contains links to these domains. Also see Links.

Domain
wordpress.org

Subject Issuer	Validity	Valid
metroblogtoday.com E1	`2023-08-05` - `2023-11-03`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://metroblogtoday.com/
Frame ID: 1F5ABF5E6D12AF665171805DCBAF66A0
Requests: 6 HTTP requests in this frame

Frame: https://metroblogtoday.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/74ac0d47/invisible.js
Frame ID: 776877B9B6479184D3C21910E5D8B93B
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

My Blog – Just another WordPress site

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Page Statistics

8
Requests

75 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

27 kB
Transfer

100 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://wordpress.org/
Title: WordPress

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 5

https://metroblogtoday.com/cdn-cgi/challenge-platform/scripts/invisible.js HTTP 302
https://metroblogtoday.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/74ac0d47/invisible.js

8 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
metroblogtoday.com/ 49 KB
11 KB 1324ms
1230ms Document
text/html 2606:4700:3037::ac43:dd16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://metroblogtoday.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:dd16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dfe597505abc3a1e9e5f41f6812ee2d48986468684d3c46aaf1501f65ae42a25

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7f3c2b261d6b1cab-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Wed, 09 Aug 2023 01:19:03 GMT
link: <https://metroblogtoday.com/index.php?rest_route=/>; rel="https://api.w.org/"
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RsRmTg0cPIxFEknyMvdt9ZIRjwel8%2B47olEv4iMfVSN3dgzL5E7ZX2mNB%2BCLNyNrHcF1VAJr5Zk%2FNLJVKwzntL%2F2MKVutY1iwiyAAB9gtEgRhENrDm3tvDukx6e%2F%2F0mLAzo0RxWycYYF2vXUuP60l%2F4%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding,User-Agent

GET
H2 200 style.min.css
metroblogtoday.com/wp-includes/blocks/navigation/ 16 KB
3 KB 289ms
289ms Stylesheet
text/css 2606:4700:3037::ac43:dd16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://metroblogtoday.com/wp-includes/blocks/navigation/style.min.css?ver=6.3
Requested by: Host: metroblogtoday.com
URL: https://metroblogtoday.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:dd16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8bc38a3ba348b745e3267b8354828f3fd3a91ba2b479331567344e33bb574580

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://metroblogtoday.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Wed, 09 Aug 2023 01:19:03 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 08 Aug 2023 21:31:24 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"3ed1-6027015be8fde-gzip"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dAKRtg9dXx6qVco%2B8EvqpCm7aNn6GxzyvDf61NoVTLcFpkiV4axQjeBaH3B%2BMy0qNkLB1n9K6N0rOlB1TnybLBj9xFsPpIumhThiSd%2FE8X7T2A1uLuzPj5wTsw3%2FAD0N0WFqmerzXBcWKO423Le0%2BGQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 7f3c2b2ddc8c1cab-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 view.min.js Show response
metroblogtoday.com/wp-includes/blocks/navigation/ 1 KB
702 B 284ms
284ms Script
application/javascript 2606:4700:3037::ac43:dd16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://metroblogtoday.com/wp-includes/blocks/navigation/view.min.js?ver=886680af40b7521d60fc
Requested by: Host: metroblogtoday.com
URL: https://metroblogtoday.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:dd16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ab818ea203ab8d42199843b83b588ccfd1709d0f2d0f9c6134705a7b214d3ad6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://metroblogtoday.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Wed, 09 Aug 2023 01:19:03 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 08 Aug 2023 21:31:24 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"470-6027015be9f7e-gzip"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GwMU%2Bo1E64vAmhkc%2FL81fqaw5BUDis25k2qt8m6wWKnUnI951Y1etY7zdi9D6RdPgauOWDd6oLnxDScplNtCi7JEI67kJmkWBtQHepETAQFyVHC8EPTkX4cHRzftBUVFfoddYpPEHjCloxJBzFABQWA%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 7f3c2b2dfc9c1cab-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 view-modal.min.js Show response
metroblogtoday.com/wp-includes/blocks/navigation/ 8 KB
3 KB 289ms
289ms Script
application/javascript 2606:4700:3037::ac43:dd16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://metroblogtoday.com/wp-includes/blocks/navigation/view-modal.min.js?ver=b478fa3cd1475dec97d3
Requested by: Host: metroblogtoday.com
URL: https://metroblogtoday.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:dd16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 54fa98ef8a13985472ddcb006b93f2f1283037b914a75de41daf3aad7a429f7d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://metroblogtoday.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Wed, 09 Aug 2023 01:19:03 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 08 Aug 2023 21:31:24 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"1e86-6027015bea74e-gzip"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=20swIMExuaGX26nMKlmivRqO9YI9z2k1n0oUJ6%2Bn9jKoWpabeLA4GaGD9klri0VCwlxeR7jLKrkfRE17d7mAFJwgTt7N1YiCij8pXdK1bZQJpNSoIrXVgGZI8agTAgmKJB98hvnkhXwctaFWRH81iIY%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 7f3c2b2dfc9d1cab-FRA
alt-svc: h3=":443"; ma=86400

GET
BLOB 200
OK 82700cfa-7a70-4a44-adf5-c19b2e8f5484
https://metroblogtoday.com/ 1 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://metroblogtoday.com/82700cfa-7a70-4a44-adf5-c19b2e8f5484
Requested by: Host: metroblogtoday.com
URL: https://metroblogtoday.com/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 453cb806084fdabec32e286af2e88899f79022125c2527afffbec507975d2c22

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Length: 1245
Content-Type: text/javascript

GET
H3 200 wp-emoji-release.min.js Show response
metroblogtoday.com/wp-includes/js/ 18 KB
5 KB 299ms
299ms Script
application/javascript 2606:4700:3037::ac43:dd16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://metroblogtoday.com/wp-includes/js/wp-emoji-release.min.js?ver=6.3
Requested by: Host: metroblogtoday.com
URL: https://metroblogtoday.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::ac43:dd16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://metroblogtoday.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Wed, 09 Aug 2023 01:19:03 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 02 Feb 2023 06:23:26 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"4904-5f3b19a3cf380-gzip"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QW1JMQvICveI8vNoWlLkK6pX2bw1%2FR4k3iwWwR%2BIYS0EMKsu0WFJo8pcAm0W413purrKCDLjeUoGVrNlkWn47e%2BcFInm2AwhiWQmEU0ZtXfmA1hTdyGst556r5ZyZgDe4Qbl2u5NdolCGZg1%2FutnoTc%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 7f3c2b2feb421909-FRA
alt-svc: h3=":443"; ma=86400

GET
H3

200

invisible.js Show response
metroblogtoday.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/74ac0d47/ Frame 7768
Redirect Chain

https://metroblogtoday.com/cdn-cgi/challenge-platform/scripts/invisible.js
https://metroblogtoday.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/74ac0d47/invisible.js

7 KB
4 KB

25ms
25ms

Script
application/javascript

2606:4700:3037::ac43:dd16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://metroblogtoday.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/74ac0d47/invisible.js

Requested by

Host: metroblogtoday.com
URL: https://metroblogtoday.com/

Protocol

Server

2606:4700:3037::ac43:dd16 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f78934563152a067db1c911c0c6d54e3b8358b39f09f615c5f02a105585daf5e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Wed, 09 Aug 2023 01:19:03 GMT
content-encoding: br
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5CXMMJtl%2BSYhKgxGjh0SpQ2eEiVELjbsk2ykDlVjT3QshZ4DVJ4eOJEzJneIJeKX9efD2UrrrYviN10gOoHSQiGxmunt7UewEk665y1pPUOqyS%2F3Bk6Id%2FDAumtTggLqYMsSQat8PXnU1u%2FJL9FwaUs%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
cf-ray: 7f3c2b302b691909-FRA
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Wed, 09 Aug 2023 01:19:03 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JyWV66rrTTBMaipQ0u%2F5wrGbakAK6wuw2sTcWidznNLtRGdmkLOwFQzy%2FmvClTIfF%2FG8DfMPmWWhVGED7AfdNDIusmPDlxPVdRQg2qraZlODB0V4JovRKysCskHRWaBKVSj3%2BbNReSe99%2F%2FMZeCTN%2Fg%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/74ac0d47/invisible.js
cache-control: max-age=300, public
cf-ray: 7f3c2b2ffb4c1909-FRA
alt-svc: h3=":443"; ma=86400

POST
H3 200 7f3c2b261d6b1cab Show response
metroblogtoday.com/cdn-cgi/challenge-platform/h/g/cv/result/ Frame 7768 0
562 B 49ms
48ms XHR
text/plain 2606:4700:3037::ac43:dd16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://metroblogtoday.com/cdn-cgi/challenge-platform/h/g/cv/result/7f3c2b261d6b1cab
Requested by: Host: metroblogtoday.com
URL: https://metroblogtoday.com/cdn-cgi/challenge-platform/scripts/invisible.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::ac43:dd16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 09 Aug 2023 01:19:03 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K%2F2vwmzUtViw5i8c77h1klVv3XbIz859BlfebIEdFe0p4DRvm73jblhUGt5md%2B58MWuDDQ3kOGGtTqxN6uRRU%2FKQZ4UDVRuzYOKBbWqe1aqD2XTxLxyX11FIdhxhN6300nTRP0wGk9iZCWMj9ZzEntg%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=UTF-8
cf-ray: 7f3c2b317c6d1909-FRA
alt-svc: h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.metroblogtoday.com/	1970-01-20 22:37:59	Name: cf_clearance Value: OP0yCFNOKSk2HI2i7w4w2f_9VkeB_2VXsgxKItcnY7c-1691543943-0-1-2aec8896.24815f2.d2dcfced-0.2.1691543943

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

metroblogtoday.com
2606:4700:3037::ac43:dd16
453cb806084fdabec32e286af2e88899f79022125c2527afffbec507975d2c22
4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230
54fa98ef8a13985472ddcb006b93f2f1283037b914a75de41daf3aad7a429f7d
8bc38a3ba348b745e3267b8354828f3fd3a91ba2b479331567344e33bb574580
ab818ea203ab8d42199843b83b588ccfd1709d0f2d0f9c6134705a7b214d3ad6
dfe597505abc3a1e9e5f41f6812ee2d48986468684d3c46aaf1501f65ae42a25
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f78934563152a067db1c911c0c6d54e3b8358b39f09f615c5f02a105585daf5e

metroblogtoday.com Open in urlscan Pro 2606:4700:3037::ac43:dd16 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

8 Requests

75 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

27 kBTransfer

100 kBSize

1 Cookies

1 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

1 Cookies

Indicators

metroblogtoday.com Open in urlscan Pro
2606:4700:3037::ac43:dd16 Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

75 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

27 kB
Transfer

100 kB
Size

1
Cookies

8 HTTP transactions
0 data transactions