0.restwaytofindreds.com Open in urlscan Pro
172.67.222.141 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://restwaytofindreds.com/?p=hbsgcnzqhe5gi3bpha4dsoa&sub2=rebrant&sub3=sp2
Effective URL:
https://0.restwaytofindreds.com/?p=hbsgcnzqhe5gi3bpha4dsoa&sub2=rebrant&sub3=sp2
Submission Tags: @phish_report
Submission: On October 12 via api (October 12th 2024, 9:31:41 am UTC) from FI — Scanned from FI

Summary HTTP 6 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 6 HTTP transactions. The main IP is 172.67.222.141, located in United States and belongs to CLOUDFLARENET, US. The main domain is 0.restwaytofindreds.com.
TLS certificate: Issued by WE1 on October 10th 2024. Valid for: 3 months.

This is the only time 0.restwaytofindreds.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
6	172.67.222.141 172.67.222.141		13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	2

6 172.67.222.141 (United States)

ASN13335 (CLOUDFLARENET, US)

restwaytofindreds.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
0.restwaytofindreds.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	restwaytofindreds.com restwaytofindreds.com 0.restwaytofindreds.com	17 KB
6	1

	Domain	Requested by
3	0.restwaytofindreds.com	restwaytofindreds.com
3	restwaytofindreds.com
6	2

This site contains no links.

Subject Issuer	Validity	Valid
restwaytofindreds.com WE1	`2024-10-10` - `2025-01-08`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://0.restwaytofindreds.com/?p=hbsgcnzqhe5gi3bpha4dsoa&sub2=rebrant&sub3=sp2
Frame ID: 910FB42ECD296D276256A30FB6085930
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

captcha

Page URL History Show full URLs

https://restwaytofindreds.com/?p=hbsgcnzqhe5gi3bpha4dsoa&sub2=rebrant&sub3=sp2 Page URL
https://0.restwaytofindreds.com/?p=hbsgcnzqhe5gi3bpha4dsoa&sub2=rebrant&sub3=sp2 Page URL

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

2
Subdomains

2
IPs

1
Countries

17 kB
Transfer

31 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://restwaytofindreds.com/?p=hbsgcnzqhe5gi3bpha4dsoa&sub2=rebrant&sub3=sp2 Page URL
https://0.restwaytofindreds.com/?p=hbsgcnzqhe5gi3bpha4dsoa&sub2=rebrant&sub3=sp2 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
3 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response restwaytofindreds.com/	18 KB 8 KB	751ms 141ms	Document text/html	172.67.222.141 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://restwaytofindreds.com/?p=hbsgcnzqhe5gi3bpha4dsoa&sub2=rebrant&sub3=sp2 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.222.141 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `4aca69da06c959b511578e25675c585863a42971b1702d9edc0e7677cef33884` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers access-control-allow-origin * alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 8d1613f76b2c56a9-OSL content-encoding zstd content-type text/html; charset=UTF-8 date Sat, 12 Oct 2024 09:31:37 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AwIZjFL2NPs4qRxnbvXsNCbWTknK%2BjNl8tcqOgTOeOcxD84hk%2B81Mp3gJQlw3FvgzjV%2FwRDhqwmZKAwJAvyAJ0yp6d0fyhQBNqUqrKIt%2BnAI2Ej5B8LdfSuG8MbAVwyoBBOpqT8OhDU%3D"}],"group":"cf-nel","max_age":604800} server cloudflare speculation-rules "/cdn-cgi/speculation"
GET H2	200	speculation restwaytofindreds.com/cdn-cgi/	128 B 465 B	171ms 170ms	Other application/speculationrules+json	172.67.222.141 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://restwaytofindreds.com/cdn-cgi/speculation Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.222.141 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://restwaytofindreds.com Referer https://restwaytofindreds.com/?p=hbsgcnzqhe5gi3bpha4dsoa&sub2=rebrant&sub3=sp2 Response headers nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Lbkfblzjibv62IzJvmK6F0QI09DfRVhIvwvMAj5MH68u7WkWLcYbpXoCtCMTWX8lzJUGh3lqyLjxcqyhQ1QSRxnBteQleCVSgwvjPo0bDZxIsWJjtLVGkrFApaifOIrO3OznnUPdHpU%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8d1613f84d4b56a9-OSL access-control-allow-origin https://restwaytofindreds.com alt-svc h3=":443"; ma=86400 content-length 128 date Sat, 12 Oct 2024 09:31:37 GMT content-type application/speculationrules+json vary Origin, Accept-Encoding server cloudflare
GET H2	204	favicon.ico restwaytofindreds.com/	0 285 B	145ms 145ms	Other text/plain	172.67.222.141 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://restwaytofindreds.com/favicon.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.222.141 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://restwaytofindreds.com/?p=hbsgcnzqhe5gi3bpha4dsoa&sub2=rebrant&sub3=sp2 Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-cache-status HIT age 6004 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MGTDIhD9F%2FmeSdAjq189EeZMTSFqFDxg1S3wmOsOgf1C7%2Btl2Js3ew2I6Gpe0mjcE2tW1Av%2BuosnD1BshXhO6yh%2FCToeOMOM20oYK7YQFfCQ5d47jWAyGV035F40edUK9Kh1JyrRYrg%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8d1613f87d7f56a9-OSL alt-svc h3=":443"; ma=86400 date Sat, 12 Oct 2024 09:31:37 GMT vary Accept-Encoding server cloudflare
GET H2	200	Primary Request / Show response 0.restwaytofindreds.com/	12 KB 7 KB	142ms 130ms	Document text/html	172.67.222.141 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://0.restwaytofindreds.com/?p=hbsgcnzqhe5gi3bpha4dsoa&sub2=rebrant&sub3=sp2 Requested by Host: restwaytofindreds.com URL: https://restwaytofindreds.com/?p=hbsgcnzqhe5gi3bpha4dsoa&sub2=rebrant&sub3=sp2 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.222.141 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `6dc51a2bd3d5f30c77f897c45425b54c595d16f43bfaf2bd984917e41dd03bbf` Request headers Referer https://restwaytofindreds.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers access-control-allow-origin * alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 8d1614053fae56a9-OSL content-encoding zstd content-type text/html; charset=UTF-8 date Sat, 12 Oct 2024 09:31:39 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G3BKrfoN9M3iRIkAshIaDOTyfERd%2B%2FPW7w1Pge5LFfbw%2Bhbnilbw6aNi8jsLiDGV74EXfhrzDKJmYtDKHbCe4pjjou04QFyKolzc5lAva%2BYWy9zevsNpVGcjG4G0aVmFxfWTxaOU0s3ZcA%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare speculation-rules "/cdn-cgi/speculation"
GET H2	200	speculation 0.restwaytofindreds.com/cdn-cgi/	128 B 433 B	89ms 87ms	Other application/speculationrules+json	172.67.222.141 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://0.restwaytofindreds.com/cdn-cgi/speculation Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.222.141 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://0.restwaytofindreds.com Referer https://0.restwaytofindreds.com/?p=hbsgcnzqhe5gi3bpha4dsoa&sub2=rebrant&sub3=sp2 Response headers nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UDOfHvVJsFxvOybQDHaqlpIYvZC9p%2BK9ILJY1VVu%2FIp5vjLi2pqcXENyNnCU%2BQZeMOiQr9J4yHGoIUVQsQxcsc8AoYopTu4VFIgmjBjfRgwsHE2Gfy%2BjqzRjpv%2Fiut%2BC63QQjfhAeLJk0g%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8d161406092056a9-OSL access-control-allow-origin https://0.restwaytofindreds.com alt-svc h3=":443"; ma=86400 content-length 128 date Sat, 12 Oct 2024 09:31:39 GMT content-type application/speculationrules+json vary Origin, Accept-Encoding server cloudflare
GET DATA	200 OK	truncated /	748 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a5308b7decd6fc2d5e8438fb037c4a822125135db832c05437d754655ff2fc23` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	378 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `6935876b0112bb2bb5aa7e27c0fdf9be86e190d47a0fbff8eb8e67e25d11f68d` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers Content-Type image/png
GET DATA	200 OK	truncated /	377 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `f9077e9ffe52966b3a279d70797b41c4eba4e6d3928471fe755fcc3856ac4b3e` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers Content-Type image/png
GET H2	204	favicon.ico 0.restwaytofindreds.com/	0 267 B	174ms 173ms	Other text/plain	172.67.222.141 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://0.restwaytofindreds.com/favicon.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.222.141 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://0.restwaytofindreds.com/?p=hbsgcnzqhe5gi3bpha4dsoa&sub2=rebrant&sub3=sp2 Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-cache-status HIT age 7094 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8pLHk6RQV8C6I%2BNubyTTii1DmIut5aWopBoL3kgTDIukxfByAe4iTXmOOtK0wq2vO5IzCOvvPGDEI%2FhV1ZgXZfX5Cfb0JcOm5tUPVRljrQmbl3Tf9RrjF%2BG%2Fhs26HcZeqKxb1zpm%2Fx%2BJsQ%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8d16140669a456a9-OSL alt-svc h3=":443"; ma=86400 date Sat, 12 Oct 2024 09:31:39 GMT vary Accept-Encoding server cloudflare

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| urlB64ToUint8Array

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.restwaytofindreds.com/	1970-01-21 00:55:17	Name: uuid Value: 28118215-8a46-4fcf-81fd-d8dd02eac571
			.0.restwaytofindreds.com/	1970-01-21 00:55:17	Name: uuid Value: 28118215-8a46-4fcf-81fd-d8dd02eac571

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0.restwaytofindreds.com
restwaytofindreds.com
172.67.222.141
11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d
4aca69da06c959b511578e25675c585863a42971b1702d9edc0e7677cef33884
6935876b0112bb2bb5aa7e27c0fdf9be86e190d47a0fbff8eb8e67e25d11f68d
6dc51a2bd3d5f30c77f897c45425b54c595d16f43bfaf2bd984917e41dd03bbf
a5308b7decd6fc2d5e8438fb037c4a822125135db832c05437d754655ff2fc23
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f9077e9ffe52966b3a279d70797b41c4eba4e6d3928471fe755fcc3856ac4b3e

0.restwaytofindreds.com Open in urlscan Pro 172.67.222.141 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

6 Requests

100 %HTTPS

0 %IPv6

1 Domains

2 Subdomains

2 IPs

1 Countries

17 kBTransfer

31 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

2 Cookies

Indicators

0.restwaytofindreds.com Open in urlscan Pro
172.67.222.141 Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

2
Subdomains

2
IPs

1
Countries

17 kB
Transfer

31 kB
Size

2
Cookies

6 HTTP transactions
3 data transactions