sugarurl.com Open in urlscan Pro
172.67.163.188 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://rangkiang.agamkab.go.id/file/data/?id=ASLIGACOR
Effective URL:
https://sugarurl.com/cdn-cgi/phish-bypass?atok=gzEwuXw7o9JXbyv1LFA.LMv1LEyWxSMiv3lxP0LQ.1k-1728792178-0.0.1.1-%2Fgass...
Submission Tags: @phish_report
Submission: On October 13 via api (October 13th 2024, 4:03:03 am UTC) from FI — Scanned from FI

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 5 domains to perform 9 HTTP transactions. The main IP is 172.67.163.188, located in United States and belongs to CLOUDFLARENET, US. The main domain is sugarurl.com.
TLS certificate: Issued by WE1 on September 11th 2024. Valid for: 3 months.

This is the only time sugarurl.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Cloudflare (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	220.247.174.179 220.247.174.179	9341 (ICONPLN-I...) (ICONPLN-ID-AP-ISP PT INDONESIA COMNETS PLUS)
1	2620:0:890::100 2620:0:890::100	54113 (FASTLY) (FASTLY)
1	2606:4700:7::eb 2606:4700:7::eb	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	162.0.235.245 162.0.235.245	22612 (NAMECHEAP...) (NAMECHEAP-NET)
5	2606:4700:303... 2606:4700:3035::ac43:a3bc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	172.67.163.188 172.67.163.188	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	4

1 220.247.174.179 (Indonesia) 1 redirects

ASN9341 (ICONPLN-ID-AP-ISP PT INDONESIA COMNETS PLUS, ID)
PTR: mailgw.agamkab.go.id

rangkiang.agamkab.go.id	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:0:890::100 (United States)

ASN54113 (FASTLY, US)

redirect98078.web.app	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:7::eb (United States)

ASN13335 (CLOUDFLARENET, US)

pub-071ea67114a54cc3a1d68875afee380f.r2.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.0.235.245 (United States) 1 redirects

ASN22612 (NAMECHEAP-NET, US)
PTR: premium160-5.web-hosting.com

mrtampan.lol	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700:3035::ac43:a3bc (United States)

ASN13335 (CLOUDFLARENET, US)

sugarurl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.67.163.188 (United States)

ASN13335 (CLOUDFLARENET, US)

sugarurl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	sugarurl.com sugarurl.com	23 KB
1	mrtampan.lol 1 redirects mrtampan.lol	220 B
1	r2.dev pub-071ea67114a54cc3a1d68875afee380f.r2.dev	365 KB
1	web.app redirect98078.web.app	1 KB
1	agamkab.go.id 1 redirects rangkiang.agamkab.go.id	464 B
9	5

	Domain	Requested by
7	sugarurl.com	sugarurl.com
1	mrtampan.lol	1 redirects
1	pub-071ea67114a54cc3a1d68875afee380f.r2.dev	redirect98078.web.app
1	redirect98078.web.app
1	rangkiang.agamkab.go.id	1 redirects
9	5

This site contains no links.

Subject Issuer	Validity	Valid
web.app WR4	`2024-09-25` - `2024-12-24`	3 months	crt.sh
*.r2.dev E5	`2024-09-29` - `2024-12-28`	3 months	crt.sh
sugarurl.com WE1	`2024-09-11` - `2024-12-10`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://sugarurl.com/cdn-cgi/phish-bypass?atok=gzEwuXw7o9JXbyv1LFA.LMv1LEyWxSMiv3lxP0LQ.1k-1728792178-0.0.1.1-%2Fgassboss
Frame ID: 745989AFF081B16567CBA3416521937A
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

403 Forbidden

Page URL History Show full URLs

https://rangkiang.agamkab.go.id/file/data/?id=ASLIGACOR HTTP 301
https://redirect98078.web.app/?id=ASLIGACOR Page URL
https://mrtampan.lol/ HTTP 302
https://sugarurl.com/gassboss Page URL
https://sugarurl.com/cdn-cgi/phish-bypass?atok=gzEwuXw7o9JXbyv1LFA.LMv1LEyWxSMiv3lxP0LQ.1k-172879... Page URL

Page Statistics

9
Requests

100 %
HTTPS

50 %
IPv6

5
Domains

5
Subdomains

4
IPs

2
Countries

389 kB
Transfer

415 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://rangkiang.agamkab.go.id/file/data/?id=ASLIGACOR HTTP 301
https://redirect98078.web.app/?id=ASLIGACOR Page URL
https://mrtampan.lol/ HTTP 302
https://sugarurl.com/gassboss Page URL
https://sugarurl.com/cdn-cgi/phish-bypass?atok=gzEwuXw7o9JXbyv1LFA.LMv1LEyWxSMiv3lxP0LQ.1k-1728792178-0.0.1.1-%2Fgassboss Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://rangkiang.agamkab.go.id/file/data/?id=ASLIGACOR HTTP 301
https://redirect98078.web.app/?id=ASLIGACOR

Request Chain 2

https://mrtampan.lol/ HTTP 302
https://sugarurl.com/gassboss

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

/ Show response
redirect98078.web.app/
Redirect Chain

https://rangkiang.agamkab.go.id/file/data/?id=ASLIGACOR
https://redirect98078.web.app/?id=ASLIGACOR

2 KB
1 KB

162ms
89ms

Document
text/html

2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://redirect98078.web.app/?id=ASLIGACOR

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

667024a58be9dbc38a0d2af8329a611693a6c3bd2f5871186b9bd8ab00ebb277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
cache-control: max-age=3600
content-encoding: br
content-length: 868
content-type: text/html; charset=utf-8
date: Sun, 13 Oct 2024 04:02:55 GMT
etag: "32b3e8665a85aee1faec82d5813e29243739ecc2c6ff9202a27a9894f1675e70-br"
last-modified: Thu, 03 Oct 2024 21:36:53 GMT
strict-transport-security: max-age=31556926; includeSubDomains; preload
vary: x-fh-requested-host, accept-encoding
x-cache: MISS
x-cache-hits: 0
x-served-by: cache-hel1410029-HEL
x-timer: S1728792176.632690,VS0,VE57

Redirect headers

content-length: 340
content-type: text/html; charset=iso-8859-1
date: Sun, 13 Oct 2024 04:02:55 GMT
location: https://redirect98078.web.app/?id=ASLIGACOR
server: nginx

GET
H/1.1 200
OK joker-removebg-preview.png
pub-071ea67114a54cc3a1d68875afee380f.r2.dev/ 365 KB
365 KB 503ms
418ms Image
image/png 2606:4700:7::eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pub-071ea67114a54cc3a1d68875afee380f.r2.dev/joker-removebg-preview.png
Requested by: Host: redirect98078.web.app
URL: https://redirect98078.web.app/?id=ASLIGACOR
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:7::eb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cbffb29748ab8c2e2745bf9263fd2a1696aab3c1854b841b6ce6068f0b06cec5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://redirect98078.web.app/

Response headers

ETag: "9bb2af761e490d0c5292ea618cb92221"
Connection: keep-alive
CF-RAY: 8d1c6fdadeab4e1b-HEL
Accept-Ranges: bytes
Content-Length: 373764
Date: Sun, 13 Oct 2024 04:02:56 GMT
Content-Type: image/png
Last-Modified: Sat, 06 Jul 2024 05:50:26 GMT
Vary: Accept-Encoding
Server: cloudflare

GET
H2

200

gassboss Show response
sugarurl.com/
Redirect Chain

https://mrtampan.lol/
https://sugarurl.com/gassboss

4 KB
2 KB

158ms
48ms

Document
text/html

2606:4700:3035::ac43:a3bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sugarurl.com/gassboss

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3035::ac43:a3bc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

328d86d0c1e7a936e44f91e64bc842bd0ff802e7de996f5be73818275dc74631

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://redirect98078.web.app/?id=ASLIGACOR
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cf-ray: 8d1c6fe94eb4c037-VNO
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Sun, 13 Oct 2024 04:02:58 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sATcslUDhy0L3bVrxl%2F0l%2FDx%2BGkAlgzMXzqADklxHlxflkceGnUSxe1ppwnKWy1%2FKfu3s2wrQ%2BRvXO%2Bgb5XbbvPPhG7MzR8lZVcWMcRh%2Bbk2pmoLcDd0QMe3%2Bb6vkCX6iqS%2FtZKv4KfwRGw%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN

Redirect headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-length: 0
content-type: text/html; charset=UTF-8
date: Sun, 13 Oct 2024 04:02:57 GMT
location: https://sugarurl.com/gassboss
server: LiteSpeed
x-powered-by: PHP/8.0.30
x-turbo-charged-by: LiteSpeed

GET
H2 403 speculation
sugarurl.com/cdn-cgi/ 0
0 53ms
53ms Other
text/html 2606:4700:3035::ac43:a3bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sugarurl.com/cdn-cgi/speculation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3035::ac43:a3bc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://sugarurl.com
Referer: https://sugarurl.com/gassboss

Response headers

content-encoding: zstd
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aFhdC0imL62RB2KIRxOIRSDSeI8FeCOL8ioBa4i5CBebBV6j5T4lJDi1oTFmMPekuRe86yff%2FZG94rquBGBAKU8X7UietqfkWFgP7U%2F5%2BkTGyyIqF4ACf1eNB%2BpLB%2BWagy%2F0ECjU57mwHhM%3D"}],"group":"cf-nel","max_age":604800}
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
expires: Thu, 01 Jan 1970 00:00:01 GMT
alt-svc: h3=":443"; ma=86400
x-content-options: nosniff
date: Sun, 13 Oct 2024 04:02:58 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: mB6UeIPRRbLNW/0+ehP13FnKD6uG6Ja3E/QKQ93z3DsbnRHfnmB999+pNPzfioSIXSafAmugQTGdS6C4DX/Yju+J6nketiU2Icv0to0SX3350pfOI51+2Kgq2FUpO21HOvwD/yzvhBI6E2CR3lVX8g==$PVfMlKof3Qa+z+zsNcZBpw==
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
speculation-rules: "/cdn-cgi/speculation"
cross-origin-resource-policy: same-origin
referrer-policy: same-origin
cf-ray: 8d1c6fe9bf36c037-VNO
cross-origin-embedder-policy: require-corp
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
origin-agent-cluster: ?1
server: cloudflare

GET
H2 200 cf.errors.css
sugarurl.com/cdn-cgi/styles/ 23 KB
5 KB 45ms
44ms Stylesheet
text/css 2606:4700:3035::ac43:a3bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sugarurl.com/cdn-cgi/styles/cf.errors.css

Requested by

Host: sugarurl.com
URL: https://sugarurl.com/gassboss

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3035::ac43:a3bc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://sugarurl.com/gassboss

Response headers

vary: Accept-Encoding
cache-control: max-age=7200, public
content-encoding: gzip
etag: W/"67055fb5-5df3"
x-content-type-options: nosniff
cf-ray: 8d1c6fe9bf3ac037-VNO
expires: Sun, 13 Oct 2024 06:02:58 GMT
date: Sun, 13 Oct 2024 04:02:58 GMT
content-type: text/css
last-modified: Tue, 08 Oct 2024 16:37:09 GMT
server: cloudflare
x-frame-options: DENY

GET
H2 200 icon-exclamation.png
sugarurl.com/cdn-cgi/images/ 452 B
541 B 45ms
45ms Image
image/png 2606:4700:3035::ac43:a3bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sugarurl.com/cdn-cgi/images/icon-exclamation.png?1376755637

Requested by

Host: sugarurl.com
URL: https://sugarurl.com/cdn-cgi/styles/cf.errors.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3035::ac43:a3bc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://sugarurl.com/cdn-cgi/styles/cf.errors.css

Response headers

vary: Accept-Encoding
cache-control: max-age=7200, public
etag: "67055fb5-1c4"
x-content-type-options: nosniff
cf-ray: 8d1c6fea0f7ac037-VNO
expires: Sun, 13 Oct 2024 06:02:58 GMT
accept-ranges: bytes
content-length: 452
date: Sun, 13 Oct 2024 04:02:58 GMT
content-type: image/png
last-modified: Tue, 08 Oct 2024 16:37:09 GMT
server: cloudflare
x-frame-options: DENY

GET
H2 403 favicon.ico
sugarurl.com/ 9 KB
7 KB 54ms
53ms Other
text/html 2606:4700:3035::ac43:a3bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sugarurl.com/favicon.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3035::ac43:a3bc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f239a54712e91bd5c51b57681ea287f8a372465628fd0a7974695d550bfad5cf

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://sugarurl.com/gassboss

Response headers

content-encoding: zstd
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IRPMBiKwXpZtLKQNUupHm4NgNMSz%2FfWeOMus1SB6noVM5501rRuQrgN2rY9ZvZfuH9jvd1f7rd5B%2FwgtEOo7ZZer%2B7duOXnaS8lcy7f9H%2B7lY4IgbLZTB5sWc0G9X9kcfHl5vIqIQy444pU%3D"}],"group":"cf-nel","max_age":604800}
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
expires: Thu, 01 Jan 1970 00:00:01 GMT
alt-svc: h3=":443"; ma=86400
x-content-options: nosniff
date: Sun, 13 Oct 2024 04:02:58 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: +AhRRqr033ooc09Z7SyT4Tv4gLuW78+SZHSjsMOQYIm2K25HaDqJY6zkvbEue6YlnVqKzvCk2p6zYtspWlwmlTFgriCp6iNn6sf81rf6uy0bsthXY/rlNs03I000RztDmSNUpwSBlj/Zkna0kq4mSQ==$bRFXWXJGPNTN1mg8ExsWjg==
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
speculation-rules: "/cdn-cgi/speculation"
cross-origin-resource-policy: same-origin
referrer-policy: same-origin
cf-ray: 8d1c6fea5fafc037-VNO
cross-origin-embedder-policy: require-corp
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
origin-agent-cluster: ?1
server: cloudflare

GET
H3 403 Primary Request phish-bypass Show response
sugarurl.com/cdn-cgi/ 553 B
293 B 61ms
60ms Document
text/html 172.67.163.188
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sugarurl.com/cdn-cgi/phish-bypass?atok=gzEwuXw7o9JXbyv1LFA.LMv1LEyWxSMiv3lxP0LQ.1k-1728792178-0.0.1.1-%2Fgassboss

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.163.188 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

982b986bb578e137f062099427a8caec3c501c84a9e4b22369ebd2badec42fe7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://sugarurl.com/gassboss
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cf-ray: 8d1c6ff08954ca38-KBP
content-encoding: gzip
content-type: text/html
date: Sun, 13 Oct 2024 04:02:59 GMT
server: cloudflare
x-content-type-options: nosniff
x-frame-options: DENY

GET
H3 403 favicon.ico
sugarurl.com/ 9 KB
8 KB 70ms
70ms Other
text/html 172.67.163.188
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sugarurl.com/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.163.188 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

74000d94b92aaf97cabacc48b535f79de1895c7df10b5dfd838083f4907704de

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://sugarurl.com/cdn-cgi/phish-bypass?atok=gzEwuXw7o9JXbyv1LFA.LMv1LEyWxSMiv3lxP0LQ.1k-1728792178-0.0.1.1-%2Fgassboss

Response headers

content-encoding: zstd
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o874vp39QP1EGQJiyQO4D%2FP9%2F27AQ2kvyjQ92TBYc0DRh1ShJ7HI4YlguOMnL%2F%2BZsAXe8107c6AKosaYDO6R3Kkcu5aBtjXuhbR4W%2BXfw1wzAY%2BLohFejsA4%2FRKMvAI%3D"}],"group":"cf-nel","max_age":604800}
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
expires: Thu, 01 Jan 1970 00:00:01 GMT
alt-svc: h3=":443"; ma=86400
x-content-options: nosniff
date: Sun, 13 Oct 2024 04:02:59 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: KPGBjCYJsFSENBhuJZK4XajwAi6LenjgAXfTn4jnakDw7lgZ8V2mJBl+XSKTMRA3SBGGQTocOf/zvuEjWC4EPY7jJWd1h+GLY88ehgIpvn+QfYplSvUNduuoQ5J9Y/vaeLkmGk+vnqwi2qPKTs2xdg==$FUk4RYe7kjFviyQEsWNxtg==
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
speculation-rules: "/cdn-cgi/speculation"
cross-origin-resource-policy: same-origin
referrer-policy: same-origin
cf-ray: 8d1c6ff10a3fca38-KBP
cross-origin-embedder-policy: require-corp
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
origin-agent-cluster: ?1
server: cloudflare

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Cloudflare (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://sugarurl.com/cdn-cgi/speculation Message: Failed to load resource: the server responded with a status of 403 ()
other	warning	URL: https://sugarurl.com/gassboss Message: Load failed or canceled (net::ERR_ABORTED; HTTP status 403) for rule set requested from "https://sugarurl.com/cdn-cgi/speculation" found in Speculation-Rules header.
network	error	URL: https://sugarurl.com/favicon.ico Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://sugarurl.com/cdn-cgi/phish-bypass?atok=gzEwuXw7o9JXbyv1LFA.LMv1LEyWxSMiv3lxP0LQ.1k-1728792178-0.0.1.1-%2Fgassboss Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://sugarurl.com/favicon.ico Message: Failed to load resource: the server responded with a status of 403 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

mrtampan.lol
pub-071ea67114a54cc3a1d68875afee380f.r2.dev
rangkiang.agamkab.go.id
redirect98078.web.app
sugarurl.com
162.0.235.245
172.67.163.188
220.247.174.179
2606:4700:3035::ac43:a3bc
2606:4700:7::eb
2620:0:890::100
328d86d0c1e7a936e44f91e64bc842bd0ff802e7de996f5be73818275dc74631
667024a58be9dbc38a0d2af8329a611693a6c3bd2f5871186b9bd8ab00ebb277
74000d94b92aaf97cabacc48b535f79de1895c7df10b5dfd838083f4907704de
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
982b986bb578e137f062099427a8caec3c501c84a9e4b22369ebd2badec42fe7
cbffb29748ab8c2e2745bf9263fd2a1696aab3c1854b841b6ce6068f0b06cec5
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
f239a54712e91bd5c51b57681ea287f8a372465628fd0a7974695d550bfad5cf

sugarurl.com Open in urlscan Pro 172.67.163.188 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

9 Requests

100 %HTTPS

50 %IPv6

5 Domains

5 Subdomains

4 IPs

2 Countries

389 kBTransfer

415 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

5 Console Messages

Security Headers

Indicators

sugarurl.com Open in urlscan Pro
172.67.163.188 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

50 %
IPv6

5
Domains

5
Subdomains

4
IPs

2
Countries

389 kB
Transfer

415 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!