billing.lts.org.ua Open in urlscan Pro
78.154.165.251 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://billing.lts.org.ua/
Effective URL:
https://billing.lts.org.ua/site/login
Submission: On October 10 via automatic, source certstream-suspicious (October 10th 2019, 5:49:58 am UTC)

Summary HTTP 9 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 78.154.165.251, located in Lviv, Ukraine and belongs to ETT-AS, UA. The main domain is billing.lts.org.ua.
TLS certificate: Issued by Let's Encrypt Authority X3 on October 9th 2019. Valid for: 3 months.

This is the only time billing.lts.org.ua was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
1 10	78.154.165.251 78.154.165.251		35320 (ETT-AS) (ETT-AS)
9	1

10 78.154.165.251 (Lviv, Ukraine) 1 redirects

ASN35320 (ETT-AS, UA)

billing.lts.org.ua	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	lts.org.ua 1 redirects billing.lts.org.ua	666 KB
9	1

	Domain	Requested by
10	billing.lts.org.ua	1 redirects billing.lts.org.ua
9	1

This site contains no links.

Subject Issuer	Validity	Valid
admin.lts.org.ua Let's Encrypt Authority X3	`2019-10-09` - `2020-01-07`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://billing.lts.org.ua/site/login
Frame ID: 4CF326B335206715390AD0970012C56E
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://billing.lts.org.ua/ HTTP 302
https://billing.lts.org.ua/site/login Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

script /\/assets\/[a-zA-Z0-9]{8}\/yii\.js$/i
script /\/yii\.(?:validation|activeForm)\.js/i

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Yii (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

script /\/assets\/[a-zA-Z0-9]{8}\/yii\.js$/i
script /\/yii\.(?:validation|activeForm)\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

9
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

666 kB
Transfer

666 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://billing.lts.org.ua/ HTTP 302
https://billing.lts.org.ua/site/login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set login Show response billing.lts.org.ua/site/ Redirect Chain https://billing.lts.org.ua/ https://billing.lts.org.ua/site/login	4 KB 2 KB	38ms 37ms	Document text/html	78.154.165.251 ETT-AS
General Check archive.org Show headers Download Go to Full URL https://billing.lts.org.ua/site/login Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 78.154.165.251 Lviv, Ukraine, ASN35320 (ETT-AS, UA), Reverse DNS Software nginx/1.10.3 / Resource Hash `84be41a1d03bd456d4f235c748980fe89e81f91e77d054ad91a58f64729fd62c` Request headers Host billing.lts.org.ua Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Sec-Fetch-Site none Accept-Encoding gzip, deflate, br Cookie PHPSESSID=l2tfm184gi6r4lkgpi6bkq4t0c Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Response headers Server nginx/1.10.3 Date Thu, 10 Oct 2019 05:49:42 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Set-Cookie _csrf=14bb55d4ef571fd01a9b1534b3012080f691f2ff6597ffeecc549686544ff8eea%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22RX46X8ugpoYRnskylXtwvEB5EmB6qWMs%22%3B%7D; path=/; HttpOnly Content-Encoding gzip Redirect headers Server nginx/1.10.3 Date Thu, 10 Oct 2019 05:49:42 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Set-Cookie PHPSESSID=l2tfm184gi6r4lkgpi6bkq4t0c; path=/; HttpOnly Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Location https://billing.lts.org.ua/site/login
GET H/1.1	200 OK	bootstrap.css billing.lts.org.ua/assets/deec69e2/css/	188 KB 188 KB	52ms 46ms	Stylesheet text/css	78.154.165.251 ETT-AS
General Check archive.org Show headers Download Go to Full URL https://billing.lts.org.ua/assets/deec69e2/css/bootstrap.css Requested by Host: billing.lts.org.ua URL: https://billing.lts.org.ua/site/login Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 78.154.165.251 Lviv, Ukraine, ASN35320 (ETT-AS, UA), Reverse DNS Software nginx/1.10.3 / Resource Hash `35fbb6dc3891aacaf1ffa07abec2344fdbc454aab533a2a03bcf93577eb7837b` Request headers Sec-Fetch-Mode no-cors Referer https://billing.lts.org.ua/site/login User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 10 Oct 2019 05:49:42 GMT Last-Modified Fri, 04 Oct 2019 09:19:26 GMT Server nginx/1.10.3 ETag "5d970e9e-2ef5c" Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 192348
GET H/1.1	200 OK	all.min.css billing.lts.org.ua/libs/fontawesome/css/	56 KB 56 KB	104ms 47ms	Stylesheet text/css	78.154.165.251 ETT-AS
General Check archive.org Show headers Download Go to Full URL https://billing.lts.org.ua/libs/fontawesome/css/all.min.css Requested by Host: billing.lts.org.ua URL: https://billing.lts.org.ua/site/login Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 78.154.165.251 Lviv, Ukraine, ASN35320 (ETT-AS, UA), Reverse DNS Software nginx/1.10.3 / Resource Hash `f8de3f57f49b005896d4c3c10979df9cff5048ddfe29ebbe36507ed1ebff60a4` Request headers Sec-Fetch-Mode no-cors Referer https://billing.lts.org.ua/site/login User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 10 Oct 2019 05:49:42 GMT Last-Modified Fri, 04 Oct 2019 00:42:57 GMT Server nginx/1.10.3 ETag "5d969591-de0a" Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 56842
GET H/1.1	200 OK	site.css billing.lts.org.ua/css/	0 233 B	84ms 27ms	Stylesheet text/css	78.154.165.251 ETT-AS
General Check archive.org Show headers Download Go to Full URL https://billing.lts.org.ua/css/site.css Requested by Host: billing.lts.org.ua URL: https://billing.lts.org.ua/site/login Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 78.154.165.251 Lviv, Ukraine, ASN35320 (ETT-AS, UA), Reverse DNS Software nginx/1.10.3 / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Sec-Fetch-Mode no-cors Referer https://billing.lts.org.ua/site/login User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 10 Oct 2019 05:49:42 GMT Last-Modified Fri, 04 Oct 2019 00:42:57 GMT Server nginx/1.10.3 ETag "5d969591-0" Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 0
GET H/1.1	200 OK	jquery.js Show response billing.lts.org.ua/assets/98ed3b03/	274 KB 274 KB	106ms 49ms	Script application/javascript	78.154.165.251 ETT-AS
General Check archive.org Show headers Download Go to Full URL https://billing.lts.org.ua/assets/98ed3b03/jquery.js Requested by Host: billing.lts.org.ua URL: https://billing.lts.org.ua/site/login Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 78.154.165.251 Lviv, Ukraine, ASN35320 (ETT-AS, UA), Reverse DNS Software nginx/1.10.3 / Resource Hash `5a93a88493aa32aab228bf4571c01207d3b42b0002409a454d404b4d8395bd55` Request headers Sec-Fetch-Mode no-cors Referer https://billing.lts.org.ua/site/login User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 10 Oct 2019 05:49:42 GMT Last-Modified Fri, 04 Oct 2019 09:19:26 GMT Server nginx/1.10.3 ETag "5d970e9e-4472c" Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 280364
GET H/1.1	200 OK	yii.js Show response billing.lts.org.ua/assets/d235100d/	20 KB 21 KB	107ms 50ms	Script application/javascript	78.154.165.251 ETT-AS
General Check archive.org Show headers Download Go to Full URL https://billing.lts.org.ua/assets/d235100d/yii.js Requested by Host: billing.lts.org.ua URL: https://billing.lts.org.ua/site/login Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 78.154.165.251 Lviv, Ukraine, ASN35320 (ETT-AS, UA), Reverse DNS Software nginx/1.10.3 / Resource Hash `796bab2b50aec1d2e2564950f8b912c6ae172281a7ecbe378dd1bc68ce7669bc` Request headers Sec-Fetch-Mode no-cors Referer https://billing.lts.org.ua/site/login User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 10 Oct 2019 05:49:42 GMT Last-Modified Fri, 04 Oct 2019 09:19:26 GMT Server nginx/1.10.3 ETag "5d970e9e-51af" Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 20911
GET H/1.1	200 OK	yii.validation.js Show response billing.lts.org.ua/assets/d235100d/	16 KB 16 KB	107ms 51ms	Script application/javascript	78.154.165.251 ETT-AS
General Check archive.org Show headers Download Go to Full URL https://billing.lts.org.ua/assets/d235100d/yii.validation.js Requested by Host: billing.lts.org.ua URL: https://billing.lts.org.ua/site/login Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 78.154.165.251 Lviv, Ukraine, ASN35320 (ETT-AS, UA), Reverse DNS Software nginx/1.10.3 / Resource Hash `1cda86823cddc4568abade65563710ad68cfd21aabc0eb972b576bcb5c349720` Request headers Sec-Fetch-Mode no-cors Referer https://billing.lts.org.ua/site/login User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 10 Oct 2019 05:49:42 GMT Last-Modified Fri, 04 Oct 2019 09:19:26 GMT Server nginx/1.10.3 ETag "5d970e9e-3ee5" Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 16101
GET H/1.1	200 OK	yii.activeForm.js Show response billing.lts.org.ua/assets/d235100d/	35 KB 35 KB	130ms 46ms	Script application/javascript	78.154.165.251 ETT-AS
General Check archive.org Show headers Download Go to Full URL https://billing.lts.org.ua/assets/d235100d/yii.activeForm.js Requested by Host: billing.lts.org.ua URL: https://billing.lts.org.ua/site/login Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 78.154.165.251 Lviv, Ukraine, ASN35320 (ETT-AS, UA), Reverse DNS Software nginx/1.10.3 / Resource Hash `b002c4b1dc823399eda98739797f56d51e15971ff3e5944de4c1407550c779a2` Request headers Sec-Fetch-Mode no-cors Referer https://billing.lts.org.ua/site/login User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 10 Oct 2019 05:49:42 GMT Last-Modified Fri, 04 Oct 2019 09:19:26 GMT Server nginx/1.10.3 ETag "5d970e9e-8aaa" Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 35498
GET H/1.1	200 OK	fa-solid-900.woff2 billing.lts.org.ua/libs/fontawesome/webfonts/	74 KB 74 KB	28ms 27ms	Font application/octet-stream	78.154.165.251 ETT-AS
General Check archive.org Show headers Download Go to Full URL https://billing.lts.org.ua/libs/fontawesome/webfonts/fa-solid-900.woff2 Requested by Host: billing.lts.org.ua URL: https://billing.lts.org.ua/site/login Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 78.154.165.251 Lviv, Ukraine, ASN35320 (ETT-AS, UA), Reverse DNS Software nginx/1.10.3 / Resource Hash `3d1080625d3030e88357b3ac9aa377dcec23f1b529c4ad03f7a9a435ccae04be` Request headers Sec-Fetch-Mode cors Referer https://billing.lts.org.ua/libs/fontawesome/css/all.min.css Origin https://billing.lts.org.ua User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 10 Oct 2019 05:49:42 GMT Last-Modified Fri, 04 Oct 2019 00:42:57 GMT Server nginx/1.10.3 ETag "5d969591-127d0" Content-Type application/octet-stream Connection keep-alive Accept-Ranges bytes Content-Length 75728

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| $ function| jQuery object| yii

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			billing.lts.org.ua/	1969-12-31 23:59:59	Name: _csrf Value: 14bb55d4ef571fd01a9b1534b3012080f691f2ff6597ffeecc549686544ff8eea%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22RX46X8ugpoYRnskylXtwvEB5EmB6qWMs%22%3B%7D
			billing.lts.org.ua/	1969-12-31 23:59:59	Name: PHPSESSID Value: l2tfm184gi6r4lkgpi6bkq4t0c

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

billing.lts.org.ua
78.154.165.251
1cda86823cddc4568abade65563710ad68cfd21aabc0eb972b576bcb5c349720
35fbb6dc3891aacaf1ffa07abec2344fdbc454aab533a2a03bcf93577eb7837b
3d1080625d3030e88357b3ac9aa377dcec23f1b529c4ad03f7a9a435ccae04be
5a93a88493aa32aab228bf4571c01207d3b42b0002409a454d404b4d8395bd55
796bab2b50aec1d2e2564950f8b912c6ae172281a7ecbe378dd1bc68ce7669bc
84be41a1d03bd456d4f235c748980fe89e81f91e77d054ad91a58f64729fd62c
b002c4b1dc823399eda98739797f56d51e15971ff3e5944de4c1407550c779a2
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f8de3f57f49b005896d4c3c10979df9cff5048ddfe29ebbe36507ed1ebff60a4