saraa.fun Open in urlscan Pro
185.229.115.6  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request gtav Show response saraa.fun/	12 KB 12 KB	99ms 28ms	Document text/html	185.229.115.6 AS-HOSTINGER
General Check archive.org Show headers Download Go to Full URL https://saraa.fun/gtav Protocol H2 Security TLS 1.3, , AES_128_GCM Server 185.229.115.6 , Germany, ASN47583 (AS-HOSTINGER, CY), Reverse DNS Software LiteSpeed / Resource Hash 34082aff94af3a83f82530a88d01cd3e2ca9b67ef018a0200f0726f42268a975 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers :method GET :authority saraa.fun :scheme https :path /gtav pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers last-modified Wed, 13 Oct 2021 17:50:00 GMT etag "301c-61671c48-e452ff15d62a70;;;" accept-ranges bytes content-length 12316 date Thu, 14 Oct 2021 11:46:17 GMT server LiteSpeed content-security-policy upgrade-insecure-requests alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
GET H2	200	bundle.min.js Show response browser.sentry-cdn.com/6.4.1/	66 KB 21 KB	32ms 7ms	Script application/javascript	2a04:4e42::729 FASTLY
General Check archive.org Show headers Download Go to Full URL https://browser.sentry-cdn.com/6.4.1/bundle.min.js Requested by Host: saraa.fun URL: https://saraa.fun/gtav Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42::729 , United States, ASN54113 (FASTLY, US), Reverse DNS Software Fastly / Resource Hash 22ece4ddd583540c08ccadf82d18658e2ed0eba5dd7fdca806aa259667edba56 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer Origin https://saraa.fun Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 14 Oct 2021 11:46:17 GMT content-encoding gzip last-modified Wed, 19 May 2021 16:36:38 GMT server Fastly age 9766225 etag "42639cce5db857005b8285dedd67553d" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000 strict-transport-security max-age=31536000; includeSubDomains accept-ranges bytes content-length 20972 expires Thu, 23 Jun 2022 10:55:53 GMT
GET H2	200	style.css saraa.fun/	13 B 109 B	30ms 29ms	Stylesheet text/html	185.229.115.6 AS-HOSTINGER
General Check archive.org Show headers Download Go to Full URL https://saraa.fun/style.css Requested by Host: saraa.fun URL: https://saraa.fun/gtav Protocol H2 Security TLS 1.3, , AES_128_GCM Server 185.229.115.6 , Germany, ASN47583 (AS-HOSTINGER, CY), Reverse DNS Software LiteSpeed / PHP/7.4.11 Resource Hash 59538cf5b94be64276276219e9692e85868d42a97ec61282f246aa0b3088e720 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers :path /style.css pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority saraa.fun :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers content-security-policy upgrade-insecure-requests content-encoding br server LiteSpeed x-powered-by PHP/7.4.11 vary Accept-Encoding content-type text/html; charset=UTF-8 date Thu, 14 Oct 2021 11:46:17 GMT content-length 17
GET H2	200	css fonts.googleapis.com/	981 B 1 KB	41ms 19ms	Stylesheet text/css	2a00:1450:4001:808::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Anton Requested by Host: saraa.fun URL: https://saraa.fun/gtav Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 77b4a53dfe83fddfeea62c10e0101bff925a490b644ad12867479d9538ecd42e Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Thu, 14 Oct 2021 10:56:19 GMT server ESF date Thu, 14 Oct 2021 11:46:17 GMT x-frame-options SAMEORIGIN report-to {"group":"AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk"}]} content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin cross-origin-opener-policy-report-only same-origin; report-to="AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk" expires Thu, 14 Oct 2021 11:46:17 GMT
GET H2	200	css fonts.googleapis.com/	997 B 489 B	44ms 23ms	Stylesheet text/css	2a00:1450:4001:808::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Goldman Requested by Host: saraa.fun URL: https://saraa.fun/gtav Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 26907cbbe8a49e3952dbf79dcf41f6498fccaea696d1de095ebd2f4b51fb822f Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Thu, 14 Oct 2021 11:46:17 GMT server ESF date Thu, 14 Oct 2021 11:46:17 GMT x-frame-options SAMEORIGIN report-to {"group":"AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk"}]} content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin cross-origin-opener-policy-report-only same-origin; report-to="AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk" expires Thu, 14 Oct 2021 11:46:17 GMT
GET H/1.1	200 OK	file-zip-icon-png-20.png www.freeiconspng.com/uploads/	63 KB 64 KB	153ms 51ms	Image image/png	2a01:4f9:2a:f67::2 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.freeiconspng.com/uploads/file-zip-icon-png-20.png Requested by Host: saraa.fun URL: https://saraa.fun/gtav Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a01:4f9:2a:f67::2 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software nginx / Resource Hash 4de17186d29eb7600299f47235955da9d21d8ec3ada202294152cbdba4540b33 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Thu, 14 Oct 2021 11:46:17 GMT MS-Author-Via DAV Last-Modified Tue, 14 Mar 2017 23:16:32 GMT Server nginx ETag "122cfa-fcdf-54ab904b61400" Content-Type image/png Cache-Control max-age=3600, no-cache, must-revalidate Connection keep-alive Accept-Ranges bytes Content-Length 64735 Expires Thu, 14 Oct 2021 12:46:17 GMT
GET H2	200	16073052103a918ef6675635e1e7687b5062a332ce.png d13pxqgp3ixdbh.cloudfront.net/uploads/	5 KB 6 KB	36ms 8ms	Image image/png	2600:9000:2156:8200:1c:b3e3:eb40:21 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://d13pxqgp3ixdbh.cloudfront.net/uploads/16073052103a918ef6675635e1e7687b5062a332ce.png Requested by Host: saraa.fun URL: https://saraa.fun/gtav Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:8200:1c:b3e3:eb40:21 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 4bb35441284180f585be602d83c255ff38f66384486b46238606f70a5c074882 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers x-amz-version-id 98NcgRlap9ylsP3MeujU7TboyXt2gAgM via 1.1 e38834cd8f7f79ef118dc9bba0861780.cloudfront.net (CloudFront) last-modified Mon, 07 Dec 2020 01:40:11 GMT server AmazonS3 age 37340 etag "cacbc7a125f943d4ce5ac54fde39dfb1" x-cache Hit from cloudfront content-type image/png date Thu, 14 Oct 2021 01:56:20 GMT x-amz-cf-pop FRA50-C1 accept-ranges bytes content-length 5534 x-amz-cf-id axuhuzjAE0LXnCNXBh2eJcpkw1xEebI92dQI0GB7bmVZT4YRpKvnTQ==
GET H2	200	maxresdefault.jpg i.ytimg.com/vi/yHP3gVyvSUA/	129 KB 130 KB	44ms 7ms	Image image/jpeg	2a00:1450:4001:82b::2016 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://i.ytimg.com/vi/yHP3gVyvSUA/maxresdefault.jpg Requested by Host: saraa.fun URL: https://saraa.fun/gtav Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::2016 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ca27892dc61afad4599033c1d47b7af79b31e1d1ade76906fece686535bf28d2 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 14 Oct 2021 11:43:08 GMT x-content-type-options nosniff age 189 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 132339 x-xss-protection 0 server sffe etag "1606047172" vary Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type image/jpeg cache-control public, max-age=7200 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Thu, 14 Oct 2021 13:43:08 GMT
GET H2	200	main.js Show response saraa.fun/	13 B 53 B	30ms 29ms	Script text/html	185.229.115.6 AS-HOSTINGER
General Check archive.org Show headers Download Go to Full URL https://saraa.fun/main.js Requested by Host: saraa.fun URL: https://saraa.fun/gtav Protocol H2 Security TLS 1.3, , AES_128_GCM Server 185.229.115.6 , Germany, ASN47583 (AS-HOSTINGER, CY), Reverse DNS Software LiteSpeed / PHP/7.4.11 Resource Hash 59538cf5b94be64276276219e9692e85868d42a97ec61282f246aa0b3088e720 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers :path /main.js pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority saraa.fun :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers content-security-policy upgrade-insecure-requests content-encoding br server LiteSpeed x-powered-by PHP/7.4.11 vary Accept-Encoding content-type text/html; charset=UTF-8 date Thu, 14 Oct 2021 11:46:17 GMT content-length 17
GET H2	200	76b8fce.js Show response d13nu0oomnx5ti.cloudfront.net/	23 KB 23 KB	40ms 9ms	Script application/javascript	2600:9000:2156:b200:3:b5aa:ad80:21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d13nu0oomnx5ti.cloudfront.net/76b8fce.js Requested by Host: saraa.fun URL: https://saraa.fun/gtav Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:b200:3:b5aa:ad80:21 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash d71b75f37cbaa198fcac72013ceb2a2fe5b68c89902dbcf4b52ae28812cb9268 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 13 Oct 2021 21:19:21 GMT via 1.1 5721f7035c3fc934bd3f96dbb04ba1e5.cloudfront.net (CloudFront) last-modified Mon, 03 May 2021 01:43:32 GMT server AmazonS3 age 52081 etag "6863f6e390060c097da580136d1dcaf2" x-cache Error from cloudfront content-type application/javascript x-amz-cf-pop FRA50-C1 content-length 23438 x-amz-cf-id Ckh0AxWAfZrr1T6jmZEaiOcoB_mMwyl2zha1TyD1OZcL8wxMqXgg0A==
GET H2	200	analytics.js Show response www.google-analytics.com/	48 KB 20 KB	30ms 7ms	Script text/javascript	2a00:1450:4001:82b::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: saraa.fun URL: https://saraa.fun/gtav Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Wed, 13 Oct 2021 16:38:54 GMT server Golfe2 age 6311 date Thu, 14 Oct 2021 10:01:06 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 19747 expires Thu, 14 Oct 2021 12:01:06 GMT
GET H2	200	pe0uMIWbN4JFplR2HDVyBw.woff2 fonts.gstatic.com/s/goldman/v5/	16 KB 17 KB	30ms 7ms	Font font/woff2	2a00:1450:4001:811::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/goldman/v5/pe0uMIWbN4JFplR2HDVyBw.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Goldman Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f6751784e3830dc1800844f669dea9ebf4c6c2d7059c3e76be6247a52de5bbeb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://saraa.fun Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 11 Oct 2021 17:30:39 GMT x-content-type-options nosniff age 238538 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 16256 x-xss-protection 0 last-modified Wed, 24 Mar 2021 17:43:40 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Tue, 11 Oct 2022 17:30:39 GMT
POST H2	429	/ Show response o425163.ingest.sentry.io/api/5780930/store/	45 B 359 B	41ms 9ms	Fetch application/json	34.120.195.249 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://o425163.ingest.sentry.io/api/5780930/store/?sentry_key=e0e6a104cb354a09bf094a90e676ea13&sentry_version=7 Requested by Host: browser.sentry-cdn.com URL: https://browser.sentry-cdn.com/6.4.1/bundle.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.120.195.249 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 249.195.120.34.bc.googleusercontent.com Software nginx / Resource Hash 77e29e7c2ef665fb66daa4adbd5a877ad518b9698c165e1a486813acf9ee84f2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://saraa.fun/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Thu, 14 Oct 2021 11:46:17 GMT via 1.1 google server nginx vary Origin content-type application/json access-control-allow-origin https://saraa.fun access-control-expose-headers x-sentry-error, retry-after, x-sentry-rate-limits x-envoy-upstream-service-time 0 strict-transport-security max-age=31536000; includeSubDomains; preload alt-svc clear content-length 45 x-sentry-rate-limits 32:default;error;security;attachment:organization:error_usage_exceeded retry-after 32
GET H2	200	html.1878949.4e2dd.0.js Show response dgu9g3a2kzqx2.cloudfront.net/public/external/v2/	10 KB 10 KB	644ms 319ms	Script application/javascript	2600:9000:2156:2000:13:652b:c180:21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://dgu9g3a2kzqx2.cloudfront.net/public/external/v2/html.1878949.4e2dd.0.js Requested by Host: d13nu0oomnx5ti.cloudfront.net URL: https://d13nu0oomnx5ti.cloudfront.net/76b8fce.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:2000:13:652b:c180:21 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 / PHP/7.4.11 Resource Hash 3c75b007fea06f8000b46f35f9f265f2154260ce265c25ba6945245b5cbf9f7f Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 14 Oct 2021 11:46:18 GMT via 1.1 a394c864b23364262af48fed4e7e9fad.cloudfront.net (CloudFront) server Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 x-amz-cf-pop FRA50-C1 x-powered-by PHP/7.4.11 x-cache Miss from cloudfront content-type application/javascript x-amz-cf-id 8X6zYYq7UKMJ5nb0QvAxfkHVVoR1hPTsKF-rWMVT_0JXNMwaZ4doKg==
GET H2	200	css_front.css dgu9g3a2kzqx2.cloudfront.net/public/external/	6 KB 7 KB	486ms 161ms	Stylesheet text/css	2600:9000:2156:2000:13:652b:c180:21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://dgu9g3a2kzqx2.cloudfront.net/public/external/css_front.css Requested by Host: d13nu0oomnx5ti.cloudfront.net URL: https://d13nu0oomnx5ti.cloudfront.net/76b8fce.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:2000:13:652b:c180:21 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 / Resource Hash a7bd79b6fba60944ee3a9c153108ff0819d2db57850116ac7065a86db08af4ec Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 14 Oct 2021 11:46:18 GMT via 1.1 a394c864b23364262af48fed4e7e9fad.cloudfront.net (CloudFront) last-modified Tue, 23 Jun 2020 20:06:47 GMT server Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 x-amz-cf-pop FRA50-C1 etag "19c4-5a8c5e62e9d0a" x-cache Miss from cloudfront content-type text/css accept-ranges bytes content-length 6596 x-amz-cf-id hO5IQCXlfmWDQbqrKQnLpOYqcwiUaykE31TFCPyET2HsywA-tv-Owg==
POST H2	429	/ Show response o425163.ingest.sentry.io/api/5780930/store/	45 B 207 B	28ms 10ms	Fetch application/json	34.120.195.249 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://o425163.ingest.sentry.io/api/5780930/store/?sentry_key=e0e6a104cb354a09bf094a90e676ea13&sentry_version=7 Requested by Host: browser.sentry-cdn.com URL: https://browser.sentry-cdn.com/6.4.1/bundle.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.120.195.249 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 249.195.120.34.bc.googleusercontent.com Software nginx / Resource Hash 77e29e7c2ef665fb66daa4adbd5a877ad518b9698c165e1a486813acf9ee84f2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://saraa.fun/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Thu, 14 Oct 2021 11:46:17 GMT via 1.1 google server nginx vary Origin content-type application/json access-control-allow-origin https://saraa.fun access-control-expose-headers retry-after, x-sentry-rate-limits, x-sentry-error x-envoy-upstream-service-time 0 strict-transport-security max-age=31536000; includeSubDomains; preload alt-svc clear content-length 45 x-sentry-rate-limits 28:default;error;security;attachment:organization:error_usage_exceeded retry-after 28
POST H2	429	/ Show response o425163.ingest.sentry.io/api/5780930/store/	45 B 207 B	27ms 10ms	Fetch application/json	34.120.195.249 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://o425163.ingest.sentry.io/api/5780930/store/?sentry_key=e0e6a104cb354a09bf094a90e676ea13&sentry_version=7 Requested by Host: browser.sentry-cdn.com URL: https://browser.sentry-cdn.com/6.4.1/bundle.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.120.195.249 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 249.195.120.34.bc.googleusercontent.com Software nginx / Resource Hash 77e29e7c2ef665fb66daa4adbd5a877ad518b9698c165e1a486813acf9ee84f2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://saraa.fun/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Thu, 14 Oct 2021 11:46:17 GMT via 1.1 google server nginx vary Origin content-type application/json access-control-allow-origin https://saraa.fun access-control-expose-headers retry-after, x-sentry-error, x-sentry-rate-limits x-envoy-upstream-service-time 0 strict-transport-security max-age=31536000; includeSubDomains; preload alt-svc clear content-length 45 x-sentry-rate-limits 10:default;error;security;attachment:organization:error_usage_exceeded retry-after 10
POST H2	200	collect Show response www.google-analytics.com/j/	2 B 202 B	14ms 13ms	XHR text/plain	2a00:1450:4001:82b::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j93&a=1556514313&t=pageView&_s=1&dl=https%3A%2F%2Fsaraa.fun%2Fgtav&ul=en-us&de=windows-1252&dt=Download%20Grand%20Theft%20Auto%20V%20mobile&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aEBAAEABAAAAAC~&jid=308741869&gjid=194543754&cid=1860716138.1634211978&tid=UA-85922709-2&_gid=918700113.1634211978&_r=1&_slc=1&cd1=0&z=240210386 Requested by Host: browser.sentry-cdn.com URL: https://browser.sentry-cdn.com/6.4.1/bundle.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 14 Oct 2021 11:46:17 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://saraa.fun cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	css.css dgu9g3a2kzqx2.cloudfront.net/public/clockers/PrimeApps/	1010 B 1 KB	159ms 158ms	Stylesheet text/css	2600:9000:2156:2000:13:652b:c180:21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://dgu9g3a2kzqx2.cloudfront.net/public/clockers/PrimeApps/css.css Requested by Host: d13nu0oomnx5ti.cloudfront.net URL: https://d13nu0oomnx5ti.cloudfront.net/76b8fce.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:2000:13:652b:c180:21 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 / Resource Hash a7081a117335212b9e7f2e348f7369a64423d51db1666310b3451e7375f0b7de Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 14 Oct 2021 11:46:18 GMT via 1.1 a394c864b23364262af48fed4e7e9fad.cloudfront.net (CloudFront) last-modified Fri, 10 Apr 2020 22:29:00 GMT server Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 x-amz-cf-pop FRA50-C1 etag "3f2-5a2f7428ae907" x-cache Miss from cloudfront content-type text/css accept-ranges bytes content-length 1010 x-amz-cf-id yjvNu204Vxb8hTG4pr3uMz6ZY4eaZlLD89qdmDo-2WvYrkhV_k27Ew==
GET H2	200	guid Show response dgu9g3a2kzqx2.cloudfront.net/public/	0 285 B	310ms 310ms	Script text/html	2600:9000:2156:2000:13:652b:c180:21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://dgu9g3a2kzqx2.cloudfront.net/public/guid?cpguid=5l4ai5uvn&e=ll&t=1634211978898 Requested by Host: d13nu0oomnx5ti.cloudfront.net URL: https://d13nu0oomnx5ti.cloudfront.net/76b8fce.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:2000:13:652b:c180:21 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 / PHP/7.4.11 Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 14 Oct 2021 11:46:19 GMT via 1.1 a394c864b23364262af48fed4e7e9fad.cloudfront.net (CloudFront) server Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 x-amz-cf-pop FRA50-C1 x-powered-by PHP/7.4.11 x-cache Miss from cloudfront content-type text/html; charset=UTF-8 content-length 0 x-amz-cf-id 5H7oh-1nJSDNraTNme-z8XSshNrs4a_iMYGxOHSkygt7jYdIF0o4Jw==
GET H2	200	check.php Show response dgu9g3a2kzqx2.cloudfront.net/public/external/	78 B 373 B	163ms 162ms	Script application/javascript	2600:9000:2156:2000:13:652b:c180:21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://dgu9g3a2kzqx2.cloudfront.net/public/external/check.php?it=1878949&time=1634211980558 Requested by Host: d13nu0oomnx5ti.cloudfront.net URL: https://d13nu0oomnx5ti.cloudfront.net/76b8fce.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:2000:13:652b:c180:21 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 / PHP/7.4.11 Resource Hash 9ef4a63fc5e0a14a7301d693d65d6acfc44cdf14853c4a20890198f2d5e52e3b Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 14 Oct 2021 11:46:20 GMT via 1.1 a394c864b23364262af48fed4e7e9fad.cloudfront.net (CloudFront) server Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 x-amz-cf-pop FRA50-C1 x-powered-by PHP/7.4.11 x-cache Miss from cloudfront content-type application/javascript content-length 78 x-amz-cf-id Oal1bveGPvtIT7hae-RUuYL_GBHn8zJryOzXz5gJfdb6CJCBEwC-vQ==

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Scam (Online)

34 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforexrselect boolean| originAgentCluster object| Sentry object| __SENTRY__ string| GoogleAnalyticsObject function| ga object| CPABUILDSETTINGS object| google_tag_data object| gaplugins object| CPABUILDContentLocker number| __cfRLUnblockHandlers function| CPBContentLocker function| CPABuildLock function| CPABuildGetFeedURL function| CPABuildGetIframeURL function| CPABuildGetIframeHTML function| CPABuildUnlock function| CPABuildOfferComplete function| CPABuildOffersComplete function| CPABuildCheckForLead function| og_load function| CPABuildComplete function| call_locker function| closeall function| showabout function| showIns object| d number| n number| h string| x function| myMenu object| gaGlobal object| gaData

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			saraa.fun/	1970-01-19 22:11:15	Name: _cpguid Value: 5l4ai5uvn
			.saraa.fun/	1970-01-20 15:28:03	Name: _ga Value: GA1.2.1860716138.1634211978
			.saraa.fun/	1970-01-19 21:58:18	Name: _gid Value: GA1.2.918700113.1634211978
			.saraa.fun/	1970-01-19 21:56:52	Name: _gat_customTemplateGlobal Value: 1

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://o425163.ingest.sentry.io/api/5780930/store/?sentry_key=e0e6a104cb354a09bf094a90e676ea13&sentry_version=7 Message: Failed to load resource: the server responded with a status of 429 ()
network	error	URL: https://o425163.ingest.sentry.io/api/5780930/store/?sentry_key=e0e6a104cb354a09bf094a90e676ea13&sentry_version=7 Message: Failed to load resource: the server responded with a status of 429 ()
network	error	URL: https://o425163.ingest.sentry.io/api/5780930/store/?sentry_key=e0e6a104cb354a09bf094a90e676ea13&sentry_version=7 Message: Failed to load resource: the server responded with a status of 429 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

browser.sentry-cdn.com
d13nu0oomnx5ti.cloudfront.net
d13pxqgp3ixdbh.cloudfront.net
dgu9g3a2kzqx2.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
i.ytimg.com
o425163.ingest.sentry.io
saraa.fun
www.freeiconspng.com
www.google-analytics.com
185.229.115.6
2600:9000:2156:2000:13:652b:c180:21
2600:9000:2156:8200:1c:b3e3:eb40:21
2600:9000:2156:b200:3:b5aa:ad80:21
2a00:1450:4001:808::200a
2a00:1450:4001:811::2003
2a00:1450:4001:82b::200e
2a00:1450:4001:82b::2016
2a01:4f9:2a:f67::2
2a04:4e42::729
34.120.195.249
22ece4ddd583540c08ccadf82d18658e2ed0eba5dd7fdca806aa259667edba56
26907cbbe8a49e3952dbf79dcf41f6498fccaea696d1de095ebd2f4b51fb822f
34082aff94af3a83f82530a88d01cd3e2ca9b67ef018a0200f0726f42268a975
3c75b007fea06f8000b46f35f9f265f2154260ce265c25ba6945245b5cbf9f7f
4bb35441284180f585be602d83c255ff38f66384486b46238606f70a5c074882
4de17186d29eb7600299f47235955da9d21d8ec3ada202294152cbdba4540b33
59538cf5b94be64276276219e9692e85868d42a97ec61282f246aa0b3088e720
77b4a53dfe83fddfeea62c10e0101bff925a490b644ad12867479d9538ecd42e
77e29e7c2ef665fb66daa4adbd5a877ad518b9698c165e1a486813acf9ee84f2
9ef4a63fc5e0a14a7301d693d65d6acfc44cdf14853c4a20890198f2d5e52e3b
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a7081a117335212b9e7f2e348f7369a64423d51db1666310b3451e7375f0b7de
a7bd79b6fba60944ee3a9c153108ff0819d2db57850116ac7065a86db08af4ec
ca27892dc61afad4599033c1d47b7af79b31e1d1ade76906fece686535bf28d2
d71b75f37cbaa198fcac72013ceb2a2fe5b68c89902dbcf4b52ae28812cb9268
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f6751784e3830dc1800844f669dea9ebf4c6c2d7059c3e76be6247a52de5bbeb
fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62