Report - urmobi.xyz/lt2x/

Report Overview

Submitted URL
urmobi.xyz/lt2x/
IP
172.67.181.207
ASN
#13335 CLOUDFLARENET
Submitted
2023-05-24 18:14:35
Access
public
Website Title
Final URL
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
urmobi.xyz	unknown	2021-03-21	2021-03-22	2023-05-23	2.2 kB	15 kB	104.21.18.120
my.rtmark.net	9054	2014-10-29	2015-02-04	2023-05-23	1.0 kB	1.9 kB	139.45.195.8
ocsp.sectigo.com	487	2018-08-16	2019-11-29	2023-05-23	330 B	963 B	104.18.14.101
propeller-tracking.com	187053	2020-04-14	2020-04-16	2023-05-23	408 B	3.7 kB	139.45.197.240
unphionetor.com	54035	2022-02-04	2022-02-11	2023-05-23	869 B	1.4 kB	139.45.197.236

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2023-05-24	medium	urmobi.xyz/lt2x/

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (2)

	URL	Size	First Seen	Last Seen
	propeller-tracking.com/fv.js?t=101486	5.2 kB	2023-03-07	2024-05-11
Pretty URL propeller-tracking.com/fv.js?t=101486 IP 139.45.197.240 ASN #9002 RETN Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:56 Last Seen2024-05-11 00:17:31 Times Seen2378 Hash 563d777535ce88943a94a6be86f378c8 8753745424d367275e3fe55a5661fe51b1e1fb72 0f467a48a494f7f63968707dc43785b728d0c17f93c12937c1e5b12798f3a98a Loading...

	my.rtmark.net/p.js?f=sync&lr=1&partner=f6c16b4316099217762dc2cce0527a0d3355158933fd6a638228d80a077807f4	697 B	2023-03-07	2023-11-22
Pretty URL my.rtmark.net/p.js?f=sync&lr=1&partner=f6c16b4316099217762dc2cce0527a0d3355158933fd6a638228d80a077807f4 IP 139.45.195.8 ASN #9002 RETN Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:27:53 Last Seen2023-11-22 11:10:18 Times Seen48 Hash 3b6b184accfac0190f1b6ea27045dade 2ebe05efd2e904af05e811e59c793d186ae62b10 a061fe57dcc7020ef047b0e62b450b6759637dfa8d94fbd16df1b092a9974f9f Loading...

HTTP Transactions (11)

URL IP Response Size

urmobi.xyz/lt2x/bot.png

104.21.18.120

200 OK

4.4 kB

URL GET HTTP/3
urmobi.xyz/lt2x/bot.png
IP
104.21.18.120:443
ASN
#13335 CLOUDFLARENET

Requested by
https://urmobi.xyz/lt2x/
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint15:92:4E:FD:FF:42:69:F1:09:AF:84:42:CB:61:33:75:98:7F:DB:6B
ValiditySun, 30 Oct 2022 00:00:00 GMT - Mon, 30 Oct 2023 23:59:59 GMT

File type
PNG image data, 229 x 233, 4-bit colormap, non-interlaced\012- data
Size
4.4 kB (4396 bytes)
Hash
4d7e827c6b6e53b5cb343929a88170db
80a8f92f1cda27257f674850197108d580675554
2c714b3a479c4a76d233e6fb36136663398b6b30054dd2e8b08b6c7dce85695c

HTTP Headers

GET /lt2x/bot.png HTTP/1.1
Host: urmobi.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://urmobi.xyz/lt2x/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 24 May 2023 18:14:19 GMT
content-type: image/png
content-length: 4396
last-modified: Sat, 24 Dec 2022 06:38:34 GMT
etag: "63a69e6a-112c"
expires: Thu, 25 May 2023 03:47:24 GMT
cache-control: max-age=86400
cf-cache-status: HIT
age: 52015
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Cg6z6NDlXNcwuc%2FjOvwvQtC1rZx2YIQvSPbA2ZvtgaxIcMaS5u3WQdCQMpzJuDsNyRbGLFxkO6YNvumF7X%2FythcvF85IleQLsNh9J8417c4nNVgvW31LD%2Fz44ocS"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7cc784849fff0b59-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

urmobi.xyz/lt2x/aaa.png

104.21.18.120

200 OK

1.9 kB

URL GET HTTP/3
urmobi.xyz/lt2x/aaa.png
IP
104.21.18.120:443
ASN
#13335 CLOUDFLARENET

Requested by
https://urmobi.xyz/lt2x/
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint15:92:4E:FD:FF:42:69:F1:09:AF:84:42:CB:61:33:75:98:7F:DB:6B
ValiditySun, 30 Oct 2022 00:00:00 GMT - Mon, 30 Oct 2023 23:59:59 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced\012- data
Size
1.9 kB (1938 bytes)
Hash
e4282730373c0e326b51ae70feacc28c
fe7dcdef53751616949d4ca1d822d004838a684e
94371047c9d0ec11f2b8b069c4edfca3d125f4d12215d9796cfbca506059a303

HTTP Headers

GET /lt2x/aaa.png HTTP/1.1
Host: urmobi.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://urmobi.xyz/lt2x/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 24 May 2023 18:14:19 GMT
content-type: image/png
content-length: 1938
last-modified: Sat, 24 Dec 2022 06:38:34 GMT
etag: "63a69e6a-792"
expires: Thu, 25 May 2023 03:47:24 GMT
cache-control: max-age=86400
cf-cache-status: HIT
age: 52015
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BEHzSPwWqsqot315x8%2BZsyoIodf4zC17ifoWC02HyUDLJ0ycZrvGxxi5KLIpUE59EeA9tKrQaQ76u2%2BgMO2ur42qdHbv6i5LzcWCLEJJx31fAFI7XqMIo4EfZElI"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7cc784849ffd0b59-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

my.rtmark.net/p.js?f=sync&lr=1&partner=f6c16b4316099217762dc2cce0527a0d3355158933fd6a638228d80a077807f4

139.45.195.8

200 OK

697 B

URL GET HTTP/2
my.rtmark.net/p.js?f=sync&lr=1&partner=f6c16b4316099217762dc2cce0527a0d3355158933fd6a638228d80a077807f4
IP
139.45.195.8:443
ASN
#9002 RETN Limited

Requested by
https://urmobi.xyz/lt2x/
Certificate
IssuerLet's Encrypt
Subjectrtmark.net
Fingerprint84:56:36:C3:24:DE:FB:F0:E7:EB:EB:9D:C8:B6:28:31:B5:3C:8B:80
ValiditySat, 06 May 2023 08:48:01 GMT - Fri, 04 Aug 2023 08:48:00 GMT

File type
ASCII text
Size
697 B (697 bytes)
Hash
3b6b184accfac0190f1b6ea27045dade
2ebe05efd2e904af05e811e59c793d186ae62b10
a061fe57dcc7020ef047b0e62b450b6759637dfa8d94fbd16df1b092a9974f9f

HTTP Headers

GET /p.js?f=sync&lr=1&partner=f6c16b4316099217762dc2cce0527a0d3355158933fd6a638228d80a077807f4 HTTP/1.1
Host: my.rtmark.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://urmobi.xyz/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 24 May 2023 18:14:19 GMT
content-type: text/javascript
content-length: 697
access-control-allow-origin: *
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2

ocsp.sectigo.com/

104.18.14.101

471 B

URL
ocsp.sectigo.com/
IP
104.18.14.101:0
ASN
#13335 CLOUDFLARENET

File type
data
Size
471 B (471 bytes)
Hash
613f7b5da709445caeea64dac70ccc2f
b2aa51cfedc60f597c804a385811792deab08e5f
ec8edff11c37c30a0ad68e2f65a2c8f6fab13f13fabbe61d57130f93b3440f59

HTTP Headers

POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 May 2023 18:14:19 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Sun, 21 May 2023 08:20:04 GMT
Expires: Sun, 28 May 2023 08:20:03 GMT
Etag: "b2aa51cfedc60f597c804a385811792deab08e5f"
Cache-Control: max-age=311054,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb1
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7cc78485eca80afa-OSL

propeller-tracking.com/fv.js?t=101486

139.45.197.240

200 OK

3.0 kB

URL GET HTTP/2
propeller-tracking.com/fv.js?t=101486
IP
139.45.197.240:443
ASN
#9002 RETN Limited

Requested by
https://urmobi.xyz/lt2x/
Certificate
IssuerSectigo Limited
Subjectpropeller-tracking.com
Fingerprint29:14:4F:57:5D:49:BB:13:F2:11:B7:FD:18:B4:E8:63:D4:8B:DC:06
ValidityFri, 04 Nov 2022 00:00:00 GMT - Mon, 06 Nov 2023 23:59:59 GMT

File type
gzip compressed data, max speed, from Unix\012- data
Size
3.0 kB (2998 bytes)
Hash
514acaa044ad55b25d6d1d4b91cf8e18
d92dcfdd3fa2134a540733df63e8c4fb1206e825
3659876c222a34cf17944649211e67fabcb85e8163ba44a769982fc5d81e84ea

HTTP Headers

GET /fv.js?t=101486 HTTP/1.1
Host: propeller-tracking.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://urmobi.xyz/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 24 May 2023 18:14:19 GMT
content-type: text/javascript; charset=utf8
access-control-allow-origin: 
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
x-trace-id: 1a721a3548ab0d4dded43ffb6c2d1a58
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
content-encoding: gzip
X-Firefox-Spdy: h2

unphionetor.com/vctx?t=101486

139.45.197.236

204 No Content

0 B

URL GET HTTP/2
unphionetor.com/vctx?t=101486
IP
139.45.197.236:443
ASN
#9002 RETN Limited

Requested by
https://urmobi.xyz/lt2x/
Certificate
IssuerLet's Encrypt
Subjectunphionetor.com
Fingerprint4B:AB:04:0A:B6:60:F0:0A:CD:92:AC:93:15:79:CF:21:57:6D:1B:97
ValiditySat, 18 Mar 2023 19:00:29 GMT - Fri, 16 Jun 2023 19:00:28 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /vctx?t=101486 HTTP/1.1
Host: unphionetor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://urmobi.xyz
DNT: 1
Connection: keep-alive
Referer: https://urmobi.xyz/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 204 No Content
server: nginx
date: Wed, 24 May 2023 18:14:20 GMT
access-control-allow-origin: https://urmobi.xyz
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
x-trace-id: 14e2f510d787270c12e84080b3a75cbd
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2

unphionetor.com/vbl?t=101486&bid=undefined&aid=undefined

139.45.197.236

204 No Content

0 B

URL POST HTTP/2
unphionetor.com/vbl?t=101486&bid=undefined&aid=undefined
IP
139.45.197.236:443
ASN
#9002 RETN Limited

Requested by
https://urmobi.xyz/lt2x/
Certificate
IssuerLet's Encrypt
Subjectunphionetor.com
Fingerprint4B:AB:04:0A:B6:60:F0:0A:CD:92:AC:93:15:79:CF:21:57:6D:1B:97
ValiditySat, 18 Mar 2023 19:00:29 GMT - Fri, 16 Jun 2023 19:00:28 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

POST /vbl?t=101486&bid=undefined&aid=undefined HTTP/1.1
Host: unphionetor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://urmobi.xyz
DNT: 1
Connection: keep-alive
Referer: https://urmobi.xyz/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
TE: trailers

HTTP/2 204 No Content
server: nginx
date: Wed, 24 May 2023 18:14:20 GMT
access-control-allow-origin: https://urmobi.xyz
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
x-trace-id: 71e264a2274ed6a352236cf66ae57e71
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2

my.rtmark.net/img.gif?f=sync&partner=f6c16b4316099217762dc2cce0527a0d3355158933fd6a638228d80a077807f4&ttl=&rurl=https%3A%2F%2Furmobi.xyz%2Flt2x%2F

139.45.195.8

200 OK

43 B

URL GET HTTP/2
my.rtmark.net/img.gif?f=sync&partner=f6c16b4316099217762dc2cce0527a0d3355158933fd6a638228d80a077807f4&ttl=&rurl=https%3A%2F%2Furmobi.xyz%2Flt2x%2F
IP
139.45.195.8:443
ASN
#9002 RETN Limited

Requested by
https://urmobi.xyz/lt2x/
Certificate
IssuerLet's Encrypt
Subjectrtmark.net
Fingerprint84:56:36:C3:24:DE:FB:F0:E7:EB:EB:9D:C8:B6:28:31:B5:3C:8B:80
ValiditySat, 06 May 2023 08:48:01 GMT - Fri, 04 Aug 2023 08:48:00 GMT

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
b4491705564909da7f9eaf749dbbfbb1
279315d507855c6a4351e1e2c2f39dd9cd2fccd8
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

HTTP Headers

GET /img.gif?f=sync&partner=f6c16b4316099217762dc2cce0527a0d3355158933fd6a638228d80a077807f4&ttl=&rurl=https%3A%2F%2Furmobi.xyz%2Flt2x%2F HTTP/1.1
Host: my.rtmark.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://urmobi.xyz/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Wed, 24 May 2023 18:14:20 GMT
content-type: image/gif
content-length: 43
access-control-allow-origin: *
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
set-cookie: ID=fc1c6d599c3b4d72837c77e0a9833159; expires=Thu, 23 May 2024 18:14:20 GMT; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2

urmobi.xyz/lt2x/favicon.ico

104.21.18.120

200 OK

1.2 kB

URL GET HTTP/3
urmobi.xyz/lt2x/favicon.ico
IP
104.21.18.120:443
ASN
#13335 CLOUDFLARENET

Requested by
https://urmobi.xyz/lt2x/
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint15:92:4E:FD:FF:42:69:F1:09:AF:84:42:CB:61:33:75:98:7F:DB:6B
ValiditySun, 30 Oct 2022 00:00:00 GMT - Mon, 30 Oct 2023 23:59:59 GMT

File type
MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel\012- data
Size
1.2 kB (1150 bytes)
Hash
b351dbddbc7258e45febcec15f0af6df
bbe96a3a52c289fef276c13e3c3fcc13a721d362
3912f125d4e25025881b30a5b88db818e8f7473ec69636fb3f9363c0f5a5b328

HTTP Headers

GET /lt2x/favicon.ico HTTP/1.1
Host: urmobi.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://urmobi.xyz/lt2x/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 24 May 2023 18:14:20 GMT
content-type: image/vnd.microsoft.icon
last-modified: Sat, 24 Dec 2022 06:38:34 GMT
etag: W/"47e-5f08d26bb8d16"
cache-control: max-age=14400
cf-cache-status: HIT
age: 4334
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rB1rYxWWkRC2M0UO4mAYM0Lpx4efsBnbhTRJ6YCicvd8zhDD%2FMR8cQYuQovuD%2BnZCCYZZjjK8%2FfvePO6KNcJzTIKJDLi37Im%2FbpXW3F1hdIYr%2BM0D%2BtpnKZvZbBM"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7cc784885cd70b59-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

urmobi.xyz/lt2x/main.css

104.21.18.120

200 OK

1.6 kB

URL GET HTTP/3
urmobi.xyz/lt2x/main.css
IP
104.21.18.120:443
ASN
#13335 CLOUDFLARENET

Requested by
https://urmobi.xyz/lt2x/
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint15:92:4E:FD:FF:42:69:F1:09:AF:84:42:CB:61:33:75:98:7F:DB:6B
ValiditySun, 30 Oct 2022 00:00:00 GMT - Mon, 30 Oct 2023 23:59:59 GMT

File type
ASCII text, with very long lines (1775), with no line terminators
Size
1.6 kB (1599 bytes)
Hash
d06b035d38692ed73c200a25e1b0f0dd
e10d545371f10774305012fb0ab325d7e7622398
08921e9d3316e779b2c94f4f06aa4470603cfdc319008f6db5b7232d2d29eacc

HTTP Headers

GET /lt2x/main.css HTTP/1.1
Host: urmobi.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://urmobi.xyz/lt2x/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 24 May 2023 18:14:19 GMT
content-type: text/css
last-modified: Sat, 24 Dec 2022 06:38:34 GMT
etag: W/"63a69e6a-63f"
expires: Thu, 25 May 2023 14:00:35 GMT
cache-control: max-age=86400
cf-cache-status: HIT
age: 15224
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2F8VEonCZQzS3X338pjl1TIIBNmVyKIrfhJ2iRNChTcil5TRB8%2BuMDb4JrFLk25AeCjiMvBXahie2FPwfZFI88udZkky1zm3bUi53I4sgyAIWjqlk%2Fggamhu5cV7c"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7cc784849fed0b59-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

urmobi.xyz/lt2x/

104.21.18.120

200 OK

2.4 kB

URL User Request GET HTTP/2
urmobi.xyz/lt2x/
IP
104.21.18.120:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint15:92:4E:FD:FF:42:69:F1:09:AF:84:42:CB:61:33:75:98:7F:DB:6B
ValiditySun, 30 Oct 2022 00:00:00 GMT - Mon, 30 Oct 2023 23:59:59 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (2570), with no line terminators
Size
2.4 kB (2412 bytes)
Hash
7e0f69f63cff444482bf2dce6af68ffc
d05cfbe5477373829555f8d9d365e89b09dc25b8
a0b07a06a4370eb96fd1ffe3d43396bf55a6ee5a6bb69a019af77f45afc0a956

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /lt2x/ HTTP/1.1
Host: urmobi.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Wed, 24 May 2023 18:14:18 GMT
content-type: text/html
x-powered-by: PHP/5.3.29
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BBLgywE%2BSFDQLeidNCGJJQFLpte0u243%2BFejNqJpLPI6Vnp2Xcy%2BPSZX%2FZ8zj2o1GJjvO3CjJ6DnrbDXkbXZavZBpKntgGrwYH%2Bd4iFUShWY2vn8ISddQ%2F%2F6J4%2FK"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7cc7847fdf95b50c-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (2)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (11)

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate