9c43r.theq0.com Open in urlscan Pro
2606:4700:3037::ac43:d206 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://tracker.club-os.com/campaign/click?VWRzimsgId=d738c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=artuklusoft...
Effective URL:
https://9c43r.theq0.com/5g52/
Submission: On February 29 via manual (February 29th 2024, 5:50:19 pm UTC) from US — Scanned from DE

Summary HTTP 3 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 3 HTTP transactions. The main IP is 2606:4700:3037::ac43:d206, located in United States and belongs to CLOUDFLARENET, US. The main domain is 9c43r.theq0.com.
TLS certificate: Issued by GTS CA 1P5 on January 21st 2024. Valid for: 3 months.

This is the only time 9c43r.theq0.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	44.206.44.177 44.206.44.177	14618 (AMAZON-AES) (AMAZON-AES)
1	213.238.183.63 213.238.183.63	213252 (CENUTA) (CENUTA)
1	2606:4700:303... 2606:4700:3037::ac43:d206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	3

1 44.206.44.177 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-206-44-177.compute-1.amazonaws.com

tracker.club-os.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 213.238.183.63 (Turkey)

ASN213252 (CENUTA, TR)
PTR: 63.183.238.213.static.cenuta.com

artuklusoft.com.tr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3037::ac43:d206 (United States)

ASN13335 (CLOUDFLARENET, US)

9c43r.theq0.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	theq0.com 9c43r.theq0.com	5 KB
1	artuklusoft.com.tr artuklusoft.com.tr	284 B
1	club-os.com 1 redirects tracker.club-os.com — Cisco Umbrella Rank: 619497	137 B
0	vabuta1.com Failed s753w.vabuta1.com Failed
3	4

	Domain	Requested by
1	9c43r.theq0.com
1	artuklusoft.com.tr
1	tracker.club-os.com	1 redirects
0	s753w.vabuta1.com Failed	9c43r.theq0.com
3	4

This site contains no links.

Subject Issuer	Validity	Valid
theq0.com GTS CA 1P5	`2024-01-21` - `2024-04-20`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://9c43r.theq0.com/5g52/
Frame ID: ED78C87F2A69A1460E4395C36BD2ACA6
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Laravel (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

Page Statistics

3
Requests

33 %
HTTPS

33 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

5 kB
Transfer

7 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://tracker.club-os.com/campaign/click?VWRzimsgId=d738c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=artuklusoft%E3%80%82com.tr/moxy/VWRzi%2F%2FYnJ5YW4ubWFydGluQG9wbS5nb3Y= HTTP 303
http://artuklusoft.com.tr/moxy/VWRzi//YnJ5YW4ubWFydGluQG9wbS5nb3Y=

3 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

YnJ5YW4ubWFydGluQG9wbS5nb3Y= Show response
artuklusoft.com.tr/moxy/VWRzi//
Redirect Chain

https://tracker.club-os.com/campaign/click?VWRzimsgId=d738c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=artuklusoft%E3%80%82com.tr/moxy/VWRzi%2F%2FYnJ5YW4ubWFydGluQG9wbS5nb3Y=
http://artuklusoft.com.tr/moxy/VWRzi//YnJ5YW4ubWFydGluQG9wbS5nb3Y=

0
284 B

226ms
59ms

Document
text/html

213.238.183.63
CENUTA

General

Check archive.org

Show headers Download Go to

Full URL: http://artuklusoft.com.tr/moxy/VWRzi//YnJ5YW4ubWFydGluQG9wbS5nb3Y=
Protocol: HTTP/1.1
Server: 213.238.183.63 , Turkey, ASN213252 (CENUTA, TR),
Reverse DNS: 63.183.238.213.static.cenuta.com
Software: LiteSpeed / PHP/7.3.33
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 29 Feb 2024 17:50:15 GMT
refresh: 0;url=https://9c43r.theq0.com/5g52/#Mbryan.martin@opm.gov
server: LiteSpeed
x-powered-by: PHP/7.3.33

Redirect headers

content-length: 0
date: Thu, 29 Feb 2024 17:50:15 GMT
location: http://artuklusoft%E3%80%82com.tr/moxy/VWRzi//YnJ5YW4ubWFydGluQG9wbS5nb3Y=
server: Apache/2.4.57 () OpenSSL/1.0.2k-fips

GET
H2 200 Primary Request / Show response
9c43r.theq0.com/5g52/ 7 KB
5 KB 664ms
596ms Document
text/html 2606:4700:3037::ac43:d206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://9c43r.theq0.com/5g52/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3037::ac43:d206 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2327a3b634852b01fdafad1b2d3fd84e69bbcb4d6a17dfb47fa3640dd5f1c1fe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://artuklusoft.com.tr/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cache-control: no-cache, private
cf-cache-status: DYNAMIC
cf-ray: 85d2bfa50d54007e-CDG
content-encoding: br
content-type: text/html; charset=UTF-8
date: Thu, 29 Feb 2024 17:50:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=B5hWqkBloJM%2BFYF7s8XL9qZGB8x500iWMWC4Qwr3%2FrAMnTDKlXhqvkszfr9cS1JEO8VGqnSPfp9IRSLLrwU%2FQGWXh5CRX8%2BBq71sNpRNIG%2FZ2hQKOXtNEKCUSaDH"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET /
s753w.vabuta1.com/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: s753w.vabuta1.com
URL: https://s753w.vabuta1.com/

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			9c43r.theq0.com/	1970-01-20 18:47:16	Name: XSRF-TOKEN Value: eyJpdiI6Ikx4K0JqR3kvR0ttaW03K3Z4eUhYM0E9PSIsInZhbHVlIjoiVjB3TDRTTDRHb0I1NjdqNzQzTHhIci9FeGxndzBxT2JGV0c4bVBwMUlNNi9aTUlmSjhkVUZpbFBnOHUzWG1WcXpkeW02c285aTlIUW9NNU9aYTFDbXdYYTVGY3BrMWloTU1vaUZ0RGxhcS83ZWhpdk9PR1dUem5iMDhyZmJxR1QiLCJtYWMiOiI2OGJmMWE3Y2QzOTdjM2MzZGJiYTY2OTc5YzM3ZDViZGY0YmNiYjc2YWFhODYwZjRkNDc0ZjkwZjBkN2NiMGIzIiwidGFnIjoiIn0%3D
			9c43r.theq0.com/	1970-01-20 18:47:16	Name: laravel_session Value: eyJpdiI6IlBoRENmNm40UHRNSG4xSEg5ZEg5YVE9PSIsInZhbHVlIjoiNzZ3cStEcUQ0bWdCV0ZmeDMxNGk5UStzRkZ6aXZtais5SS9QdmVFYjRvZ3RtVmoranRnZ09YSkt3c0xKaE1QMXZuUjB0U0VpLzVvcXRvUEp1RG5IdXNrYk5oYzBTY0puMmNlLzNtU3RlUis4WVlNd0RYUGtwcnVIeldQcmFXUWwiLCJtYWMiOiIxN2NmNWU3Zjc5Nzc0ZTkxNzg5MGIwZmU4ZDAzNDdmNzg3YjI1ODVkZDk0YmQxYTU1NmRiZmRmYmZhMTQxMjdjIiwidGFnIjoiIn0%3D

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

9c43r.theq0.com
artuklusoft.com.tr
s753w.vabuta1.com
tracker.club-os.com
s753w.vabuta1.com
213.238.183.63
2606:4700:3037::ac43:d206
44.206.44.177
2327a3b634852b01fdafad1b2d3fd84e69bbcb4d6a17dfb47fa3640dd5f1c1fe
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

9c43r.theq0.com Open in urlscan Pro 2606:4700:3037::ac43:d206 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

3 Requests

33 %HTTPS

33 %IPv6

4 Domains

4 Subdomains

3 IPs

2 Countries

5 kBTransfer

7 kBSize

2 Cookies

0 Outgoing links

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

2 Cookies

Indicators

9c43r.theq0.com Open in urlscan Pro
2606:4700:3037::ac43:d206 Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

33 %
HTTPS

33 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

5 kB
Transfer

7 kB
Size

2
Cookies

3 HTTP transactions
0 data transactions