urlscan.io logo urlscan.io
SecurityTrails logo

zec6hc.e3x8g01.xyz Open in urlscan Pro
172.67.217.94  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://ziplar.shop/
Effective URL: https://zec6hc.e3x8g01.xyz/
Submission Tags: @phish_report
Submission: On May 15 via api from FI — Scanned from AU
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 1 countries across 4 domains to perform 5 HTTP transactions. The main IP is 172.67.217.94, located in and belongs to . The main domain is zec6hc.e3x8g01.xyz.
TLS certificate: Issued by E1 on May 15th 2024. Valid for: 3 months.
This is the only time zec6hc.e3x8g01.xyz was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 77.91.66.94 215428 (MYKYTASKOROB)
1 1 85.119.149.127 50340 (SELECTEL-MSK)
1 1 172.67.152.145 ()
1 172.67.217.94 ()
5 3
Apex Domain
Subdomains		 Transfer
2 ziplar.shop
ziplar.shop
3 KB
1 e3x8g01.xyz
zec6hc.e3x8g01.xyz
1 oriwefial.xyz
oriwefial.xyz
666 B
1 ozistar.top
ozistar.top
159 B
5 4
Domain Requested by
2 ziplar.shop
1 zec6hc.e3x8g01.xyz zec6hc.e3x8g01.xyz
1 oriwefial.xyz 1 redirects
1 ozistar.top 1 redirects
5 4

This site contains no links.

Subject Issuer Validity Valid
ziplar.shop
R3		 2024-05-14 -
2024-08-12		 3 months crt.sh
e3x8g01.xyz
E1		 2024-05-15 -
2024-08-13		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://zec6hc.e3x8g01.xyz/
Frame ID: 7A6A1ED6790C40C7D30B90C76F431291
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://ziplar.shop/ HTTP 307
    https://ziplar.shop/ Page URL
  2. https://ozistar.top/live.php HTTP 302
    https://oriwefial.xyz/?s=YNLwK8Ylqe HTTP 302
    https://zec6hc.e3x8g01.xyz/ Page URL

Page Statistics

5
Requests

60 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

3
IPs

1
Countries

3 kB
Transfer

8 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://ziplar.shop/ HTTP 307
    https://ziplar.shop/ Page URL
  2. https://ozistar.top/live.php HTTP 302
    https://oriwefial.xyz/?s=YNLwK8Ylqe HTTP 302
    https://zec6hc.e3x8g01.xyz/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://ziplar.shop/ HTTP 307
  • https://ziplar.shop/

5 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
ziplar.shop/
Redirect Chain
  • http://ziplar.shop/
  • https://ziplar.shop/
5 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ziplar.shop/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
77.91.66.94 , Russian Federation, ASN215428 (MYKYTASKOROB, UA),
Reverse DNS
Software
openresty / PHP/7.2.30
Resource Hash
dbf6a23ba69538402e9c23d738c5bf33df00a07ed7bc35c008519ed21ec79e1b

Request headers

Accept-Language
en-AU,en;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Wed, 15 May 2024 09:50:08 GMT
Server
openresty
Transfer-Encoding
chunked
X-Powered-By
PHP/7.2.30

Redirect headers

Location
https://ziplar.shop/
Non-Authoritative-Reason
HttpsUpgrades
Primary Request /
zec6hc.e3x8g01.xyz/
Redirect Chain
  • https://ozistar.top/live.php
  • https://oriwefial.xyz/?s=YNLwK8Ylqe
  • https://zec6hc.e3x8g01.xyz/
3 KB
0 		Document
General
Check archive.org
Download Go to
Full URL
https://zec6hc.e3x8g01.xyz/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.217.94 -, , ASN (),
Reverse DNS
Software
cloudflare / PHP/8.2.18
Resource Hash

Request headers

Accept-Language
en-AU,en;q=0.9;q=0.9
Referer
https://ziplar.shop/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
884238f0fe67a835-SYD
content-encoding
br
content-type
text/html; charset=UTF-8
date
Wed, 15 May 2024 09:50:13 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E5jJyMLm6dV%2BAH%2FXGoJlMlJi78K0g6g3qUU3tywfv0vIJ6Mi1iCyZCfjGDKnUTP17zjXMInzcBVmpprVTrDLqlDNAHfruJuv6LBrWQRKhd5Hvtv9X18EptkY6b18NQoQK4OO07g%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
PHP/8.2.18

Redirect headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
884238e89dc6dfab-SYD
content-type
text/html; charset=UTF-8
date
Wed, 15 May 2024 09:50:12 GMT
location
https://zec6hc.e3x8g01.xyz
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IKRkaDPeAR14eEnLYNHJjlG%2BrqP39C5iigIOpAUTWN9CzdryjSIfJ6pY%2BCNKAEN76N4uyEPJx9hvTyzq%2FWVaFDcktAtYI%2FSXHlvHOKorVdooqZb7covuWykb6MKcIt4c"}],"group":"cf-nel","max_age":604800}
server
cloudflare
favicon.ico
ziplar.shop/ 		150 B
304 B 		Other
General
Check archive.org
Download Go to
Full URL
https://ziplar.shop/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
77.91.66.94 , Russian Federation, ASN215428 (MYKYTASKOROB, UA),
Reverse DNS
Software
openresty /
Resource Hash

Request headers

Accept-Language
en-AU,en;q=0.9;q=0.9
Referer
https://ziplar.shop/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

Date
Wed, 15 May 2024 09:50:08 GMT
Content-Encoding
gzip
Server
openresty
Connection
keep-alive
Transfer-Encoding
chunked
Content-Type
text/html
main.dc5d96e6.js
zec6hc.e3x8g01.xyz/static/js/ 		0
0
main.fb627ea7.css
zec6hc.e3x8g01.xyz/static/css/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
zec6hc.e3x8g01.xyz
URL
https://zec6hc.e3x8g01.xyz/static/js/main.dc5d96e6.js?4545454534434336443436564213435g43456434233343423443434343446563434343443444334344342364345434443465434343444434454343443443434343594309886576544343543443435443544344343343433243435454354434435432433246544333434343343265323232443332323232434344343434334343434343434343434343433232454343132=434343231
Domain
zec6hc.e3x8g01.xyz
URL
https://zec6hc.e3x8g01.xyz/static/css/main.fb627ea7.css?4343434434434545454543443433254433243431=123232

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

1 Console Messages

Source Level URL
Text
network error URL: https://ziplar.shop/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

oriwefial.xyz
ozistar.top
zec6hc.e3x8g01.xyz
ziplar.shop
zec6hc.e3x8g01.xyz
172.67.152.145
172.67.217.94
77.91.66.94
85.119.149.127
dbf6a23ba69538402e9c23d738c5bf33df00a07ed7bc35c008519ed21ec79e1b