www.suppotrs.gq Open in urlscan Pro
2606:4700:3037::ac43:a7da  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://www.suppotrs.gq/n/en/ Page URL
2. https://www.suppotrs.gq/n/en/season.php?country.x=7e97dfbe046a33c7735c4e0ff36d18407e97dfbe046a33c7735c4e0ff36d1840 Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response www.suppotrs.gq/n/en/	130 B 811 B	481ms 457ms	Document text/html	2606:4700:3037::ac43:a7da CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.suppotrs.gq/n/en/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:a7da , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 68abe6b387b4e20178358238fb78d145dbcef6bbf4f81bf0cc5d15fefb7ce99b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers :method GET :authority www.suppotrs.gq :scheme https :path /n/en/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Sat, 10 Oct 2020 23:57:21 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=df6154e29575a14c37676d475bc10e3721602374240; expires=Mon, 09-Nov-20 23:57:20 GMT; path=/; domain=.suppotrs.gq; HttpOnly; SameSite=Lax; Secure PHPSESSID=5fuuiosce6p7vp44k1uh9clgh2; path=/ expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 pragma no-cache x-xss-protection 1; mode=block x-content-type-options nosniff x-request-id c703be3631039e15e21d662172d78ea2 cf-cache-status DYNAMIC cf-request-id 05b68ba2540000dfef4c83e200000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602374241"}],"group":"cf-nel","max_age":604800} nel {"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 5e04487d5c57dfef-FRA content-encoding br
GET H2	200	Primary Request season.php Show response www.suppotrs.gq/n/en/	17 KB 13 KB	760ms 760ms	Document text/html	2606:4700:3037::ac43:a7da CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.suppotrs.gq/n/en/season.php?country.x=7e97dfbe046a33c7735c4e0ff36d18407e97dfbe046a33c7735c4e0ff36d1840 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:a7da , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2bcd8f226737e212ea158998d57bc406c217407d0a084cf8b564944076ac6a21 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers :method GET :authority www.suppotrs.gq :scheme https :path /n/en/season.php?country.x=7e97dfbe046a33c7735c4e0ff36d18407e97dfbe046a33c7735c4e0ff36d1840 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site same-origin sec-fetch-mode navigate sec-fetch-dest document referer https://www.suppotrs.gq/n/en/ accept-encoding gzip, deflate, br accept-language en-US cookie __cfduid=df6154e29575a14c37676d475bc10e3721602374240; PHPSESSID=5fuuiosce6p7vp44k1uh9clgh2 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.suppotrs.gq/n/en/ Response headers status 200 date Sat, 10 Oct 2020 23:57:22 GMT content-type text/html; charset=UTF-8 expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 pragma no-cache x-xss-protection 1; mode=block x-content-type-options nosniff x-request-id 055ab48c0c7235b2b5458c0f837d4e48 cf-cache-status DYNAMIC cf-request-id 05b68ba4260000dfef4c84a200000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602374242"}],"group":"cf-nel","max_age":604800} nel {"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 5e0448803fd1dfef-FRA content-encoding br
GET H2	200	khawarezmialgo.js Show response www.suppotrs.gq/n/en/js/	6 KB 2 KB	12ms 11ms	Script application/javascript	2606:4700:3037::ac43:a7da CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.suppotrs.gq/n/en/js/khawarezmialgo.js Requested by Host: www.suppotrs.gq URL: https://www.suppotrs.gq/n/en/season.php?country.x=7e97dfbe046a33c7735c4e0ff36d18407e97dfbe046a33c7735c4e0ff36d1840 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:a7da , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2928ccd2f7be90261b07e10c8fff683884d9fcf524d24463a1ee71e9c8c0a697 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://www.suppotrs.gq/n/en/season.php?country.x=7e97dfbe046a33c7735c4e0ff36d18407e97dfbe046a33c7735c4e0ff36d1840 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 10 Oct 2020 23:57:22 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 3233 cf-polished origSize=9756 status 200 cf-request-id 05b68ba7260000dfef4c861200000001 x-request-id 83b49d061c77af083060cb8bf5318823 last-modified Wed, 09 Sep 2020 21:48:53 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602374242"}],"group":"cf-nel","max_age":604800} content-type application/javascript x-xss-protection 1; mode=block cache-control max-age=14400 cf-ray 5e0448850caddfef-FRA cf-bgj minify
GET H2	200	contextualLogin.css www.suppotrs.gq/n/en/System/	57 KB 10 KB	17ms 16ms	Stylesheet text/css	2606:4700:3037::ac43:a7da CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.suppotrs.gq/n/en/System/contextualLogin.css Requested by Host: www.suppotrs.gq URL: https://www.suppotrs.gq/n/en/season.php?country.x=7e97dfbe046a33c7735c4e0ff36d18407e97dfbe046a33c7735c4e0ff36d1840 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:a7da , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 07462df8ade26a4342fbb1e9a19cce6f2a9875790b1a84abf84ae508978952d9 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://www.suppotrs.gq/n/en/season.php?country.x=7e97dfbe046a33c7735c4e0ff36d18407e97dfbe046a33c7735c4e0ff36d1840 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 10 Oct 2020 23:57:22 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 3233 cf-polished origSize=75973 status 200 cf-request-id 05b68ba7a60000dfef4c868200000001 x-request-id 5ac16215c7884ba67e52454d72b25a88 last-modified Wed, 09 Sep 2020 21:48:53 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602374242"}],"group":"cf-nel","max_age":604800} content-type text/css x-xss-protection 1; mode=block cache-control max-age=14400 cf-ray 5e044885dd8bdfef-FRA cf-bgj minify
GET H2	200	jquery-3.2.1.min.js Show response code.jquery.com/	85 KB 30 KB	26ms 8ms	Script application/javascript	2001:4de0:ac19::1:b:2b HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.2.1.min.js Requested by Host: www.suppotrs.gq URL: https://www.suppotrs.gq/n/en/season.php?country.x=7e97dfbe046a33c7735c4e0ff36d18407e97dfbe046a33c7735c4e0ff36d1840 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac19::1:b:2b , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash 87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de Request headers Referer https://www.suppotrs.gq/n/en/season.php?country.x=7e97dfbe046a33c7735c4e0ff36d18407e97dfbe046a33c7735c4e0ff36d1840 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Sat, 10 Oct 2020 23:57:22 GMT content-encoding gzip last-modified Mon, 20 Mar 2017 19:01:15 GMT server nginx status 200 etag W/"58d026fb-15283" vary Accept-Encoding x-hw 1602374242.dop137.fr8.t,1602374242.cds244.fr8.hn,1602374242.cds133.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30125
GET H2	200	login.js Show response www.suppotrs.gq/n/en/js/	4 KB 834 B	14ms 13ms	Script application/javascript	2606:4700:3037::ac43:a7da CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.suppotrs.gq/n/en/js/login.js Requested by Host: www.suppotrs.gq URL: https://www.suppotrs.gq/n/en/season.php?country.x=7e97dfbe046a33c7735c4e0ff36d18407e97dfbe046a33c7735c4e0ff36d1840 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:a7da , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 176a3a57730378db174ae75721b0f7263fb1e4ec5115615eba0330109795d91e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://www.suppotrs.gq/n/en/season.php?country.x=7e97dfbe046a33c7735c4e0ff36d18407e97dfbe046a33c7735c4e0ff36d1840 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 10 Oct 2020 23:57:22 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 3233 cf-polished origSize=4374 status 200 cf-request-id 05b68ba7a60000dfef4c869200000001 x-request-id 8de9262c323a3e568eec38526c094eb0 last-modified Wed, 09 Sep 2020 21:48:53 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602374242"}],"group":"cf-nel","max_age":604800} content-type application/javascript x-xss-protection 1; mode=block cache-control max-age=14400 cf-ray 5e044885dd8cdfef-FRA cf-bgj minify
GET H2	200	plugins.js Show response www.suppotrs.gq/n/en/js/	34 KB 10 KB	13ms 12ms	Script application/javascript	2606:4700:3037::ac43:a7da CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.suppotrs.gq/n/en/js/plugins.js Requested by Host: www.suppotrs.gq URL: https://www.suppotrs.gq/n/en/season.php?country.x=7e97dfbe046a33c7735c4e0ff36d18407e97dfbe046a33c7735c4e0ff36d1840 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:a7da , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1dc8f2acdfbb612d8f2b69502dfcf8377c3f529b955128d95448073a76d2402d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://www.suppotrs.gq/n/en/season.php?country.x=7e97dfbe046a33c7735c4e0ff36d18407e97dfbe046a33c7735c4e0ff36d1840 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 10 Oct 2020 23:57:22 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 3233 cf-polished origSize=55810 status 200 cf-request-id 05b68ba7a60000dfef4c86a200000001 x-request-id 5a99f2c15f3dda7463d6eac723179ada last-modified Wed, 09 Sep 2020 21:48:53 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602374242"}],"group":"cf-nel","max_age":604800} content-type application/javascript x-xss-protection 1; mode=block cache-control max-age=14400 cf-ray 5e044885dd8edfef-FRA cf-bgj minify
GET H2	200	cfpp.svg www.suppotrs.gq/n/en/css/shared/	5 KB 2 KB	13ms 13ms	Image image/svg+xml	2606:4700:3037::ac43:a7da CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.suppotrs.gq/n/en/css/shared/cfpp.svg Requested by Host: www.suppotrs.gq URL: https://www.suppotrs.gq/n/en/System/contextualLogin.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:a7da , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://www.suppotrs.gq/n/en/System/contextualLogin.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 10 Oct 2020 23:57:22 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 3232 status 200 cf-request-id 05b68ba7d50000dfef4c86e200000001 x-request-id eb95d0abd0105734b957866618df2e01 last-modified Wed, 09 Sep 2020 21:48:53 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602374242"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml x-xss-protection 1; mode=block cache-control max-age=14400 cf-ray 5e0448862dcedfef-FRA

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes object| Aes object| Base64 object| Utf8 string| khawarezmifou string| khawarezmic string| output string| ctrTxt function| $ function| jQuery function| validateEmail function| makeid

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.suppotrs.gq/	1969-12-31 23:59:59	Name: PHPSESSID Value: 5fuuiosce6p7vp44k1uh9clgh2
			.suppotrs.gq/	1970-01-19 13:49:26	Name: __cfduid Value: df6154e29575a14c37676d475bc10e3721602374240

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
www.suppotrs.gq
2001:4de0:ac19::1:b:2b
2606:4700:3037::ac43:a7da
07462df8ade26a4342fbb1e9a19cce6f2a9875790b1a84abf84ae508978952d9
176a3a57730378db174ae75721b0f7263fb1e4ec5115615eba0330109795d91e
1dc8f2acdfbb612d8f2b69502dfcf8377c3f529b955128d95448073a76d2402d
2928ccd2f7be90261b07e10c8fff683884d9fcf524d24463a1ee71e9c8c0a697
2bcd8f226737e212ea158998d57bc406c217407d0a084cf8b564944076ac6a21
68abe6b387b4e20178358238fb78d145dbcef6bbf4f81bf0cc5d15fefb7ce99b
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5