64rgg.b0t22.com - urlscan.io

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 5 HTTP transactions. The main IP is 2606:4700:3031::6815:593b, located in United States and belongs to CLOUDFLARENET, US. The main domain is 64rgg.b0t22.com.
TLS certificate: Issued by E1 on November 30th 2023. Valid for: 3 months.

This is the only time 64rgg.b0t22.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Cloudflare (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	108.167.183.97 108.167.183.97	19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING)
4	2606:4700:303... 2606:4700:3031::6815:593b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2

1 108.167.183.97 (United States)

ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: bacisac.pe

twitterlipw.taqueriamiguelitosdenton.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:3031::6815:593b (United States)

ASN13335 (CLOUDFLARENET, US)

64rgg.b0t22.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	b0t22.com 64rgg.b0t22.com	8 KB
1	taqueriamiguelitosdenton.com twitterlipw.taqueriamiguelitosdenton.com	332 B
5	2

	Domain	Requested by
4	64rgg.b0t22.com	twitterlipw.taqueriamiguelitosdenton.com 64rgg.b0t22.com
1	twitterlipw.taqueriamiguelitosdenton.com
5	2

This site contains no links.

Subject Issuer	Validity	Valid
taqueriamiguelitosdenton.com R3	`2023-11-21` - `2024-02-19`	3 months	crt.sh
b0t22.com E1	`2023-11-30` - `2024-02-28`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://64rgg.b0t22.com/cdn-cgi/phish-bypass?atok=8B1JghSy0hkgsOtS9MGipUzfdMBcDA7XrZzysWDOykM-1702255355-0-%2Feli55e
Frame ID: B825A67B93ABA4487ED0B52E56B033C6
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

403 Forbidden

Page URL History Show full URLs

https://twitterlipw.taqueriamiguelitosdenton.com/zwtlyxjuzxlaa2vhcm5lewnvlmnvbq== Page URL
https://64rgg.b0t22.com/eli55e Page URL
https://64rgg.b0t22.com/cdn-cgi/phish-bypass?atok=8B1JghSy0hkgsOtS9MGipUzfdMBcDA7XrZzysWDOykM-170225... Page URL

Page Statistics

5
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

8 kB
Transfer

29 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://twitterlipw.taqueriamiguelitosdenton.com/zwtlyxjuzxlaa2vhcm5lewnvlmnvbq== Page URL
https://64rgg.b0t22.com/eli55e Page URL
https://64rgg.b0t22.com/cdn-cgi/phish-bypass?atok=8B1JghSy0hkgsOtS9MGipUzfdMBcDA7XrZzysWDOykM-1702255355-0-%2Feli55e Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 zwtlyxjuzxlaa2vhcm5lewnvlmnvbq==
twitterlipw.taqueriamiguelitosdenton.com/ 129 B
332 B 1323ms
1143ms Document
text/html 108.167.183.97
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://twitterlipw.taqueriamiguelitosdenton.com/zwtlyxjuzxlaa2vhcm5lewnvlmnvbq==
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.167.183.97 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: bacisac.pe
Software: Apache /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 131
content-type: text/html; charset=UTF-8
date: Mon, 11 Dec 2023 00:42:34 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding

GET
H2 200 eli55e Show response
64rgg.b0t22.com/ 5 KB
2 KB 260ms
75ms Document
text/html 2606:4700:3031::6815:593b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://64rgg.b0t22.com/eli55e

Requested by

Host: twitterlipw.taqueriamiguelitosdenton.com
URL: https://twitterlipw.taqueriamiguelitosdenton.com/zwtlyxjuzxlaa2vhcm5lewnvlmnvbq==

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3031::6815:593b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

91640a6b0ceeee22b427c689640dda17392b33f7909775db00a832dbd3a84878

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://twitterlipw.taqueriamiguelitosdenton.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-ray: 8339b0463c679acb-MIA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Mon, 11 Dec 2023 00:42:35 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jAn%2Bjk57MwaAZkkqN0UPiXAz9ndMaF5t9EHo7Q%2ByeVZ3%2BLEFDXRMZEZJuRWJ7WoUb9l4tgPLJhnMQDO%2F3PddRRSmCdDKRh7XTI5MQ7M2B0v8xADuE46OHPHqyQ3uNf6sYpdL9D2RxyBxR8dWPSs%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-frame-options: SAMEORIGIN

GET
H2 200 cf.errors.css
64rgg.b0t22.com/cdn-cgi/styles/ 24 KB
5 KB 43ms
41ms Stylesheet
text/css 2606:4700:3031::6815:593b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://64rgg.b0t22.com/cdn-cgi/styles/cf.errors.css

Requested by

Host: 64rgg.b0t22.com
URL: https://64rgg.b0t22.com/eli55e

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3031::6815:593b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1103290e25ebda2712abe344a87facbac00ddaba712729be9fe5feef807bf91b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://64rgg.b0t22.com/eli55e
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 00:42:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 01 Dec 2023 15:04:24 GMT
server: cloudflare
etag: W/"6569f5f8-5e44"
x-frame-options: DENY
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=7200, public
cf-ray: 8339b0475e2a9acb-MIA
expires: Mon, 11 Dec 2023 02:42:36 GMT

GET
H2 200 icon-exclamation.png
64rgg.b0t22.com/cdn-cgi/images/ 452 B
541 B 36ms
35ms Image
image/png 2606:4700:3031::6815:593b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://64rgg.b0t22.com/cdn-cgi/images/icon-exclamation.png?1376755637

Requested by

Host: 64rgg.b0t22.com
URL: https://64rgg.b0t22.com/cdn-cgi/styles/cf.errors.css

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3031::6815:593b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://64rgg.b0t22.com/cdn-cgi/styles/cf.errors.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 00:42:36 GMT
x-content-type-options: nosniff
last-modified: Fri, 01 Dec 2023 15:04:24 GMT
server: cloudflare
etag: "6569f5f8-1c4"
x-frame-options: DENY
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=7200, public
accept-ranges: bytes
cf-ray: 8339b047aeac9acb-MIA
content-length: 452
expires: Mon, 11 Dec 2023 02:42:36 GMT

GET
H3 403 Primary Request phish-bypass Show response
64rgg.b0t22.com/cdn-cgi/ 553 B
293 B 37ms
36ms Document
text/html 2606:4700:3031::6815:593b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://64rgg.b0t22.com/cdn-cgi/phish-bypass?atok=8B1JghSy0hkgsOtS9MGipUzfdMBcDA7XrZzysWDOykM-1702255355-0-%2Feli55e

Protocol

H3

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::6815:593b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

982b986bb578e137f062099427a8caec3c501c84a9e4b22369ebd2badec42fe7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://64rgg.b0t22.com/eli55e
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cf-ray: 8339b068ca8e3341-MIA
content-encoding: gzip
content-type: text/html
date: Mon, 11 Dec 2023 00:42:41 GMT
server: cloudflare
x-content-type-options: nosniff
x-frame-options: DENY

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Cloudflare (Online)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			twitterlipw.taqueriamiguelitosdenton.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: a0fb5c70eb71fc5d106a662fa5ceaa94

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://64rgg.b0t22.com/cdn-cgi/phish-bypass?atok=8B1JghSy0hkgsOtS9MGipUzfdMBcDA7XrZzysWDOykM-1702255355-0-%2Feli55e Message: Failed to load resource: the server responded with a status of 403 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

64rgg.b0t22.com
twitterlipw.taqueriamiguelitosdenton.com
108.167.183.97
2606:4700:3031::6815:593b
1103290e25ebda2712abe344a87facbac00ddaba712729be9fe5feef807bf91b
91640a6b0ceeee22b427c689640dda17392b33f7909775db00a832dbd3a84878
982b986bb578e137f062099427a8caec3c501c84a9e4b22369ebd2badec42fe7
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

64rgg.b0t22.com Open in urlscan Pro 2606:4700:3031::6815:593b Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

5 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

8 kBTransfer

29 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

64rgg.b0t22.com Open in urlscan Pro
2606:4700:3031::6815:593b Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

8 kB
Transfer

29 kB
Size

1
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!