ticket.d36.com.br Open in urlscan Pro
191.37.224.208 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://ticket.d36.com.br/
Effective URL:
https://ticket.d36.com.br/probe.php
Submission: On September 19 via automatic, source certstream-suspicious (September 19th 2022, 4:17:53 pm UTC) — Scanned from DE

Summary HTTP 10 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 10 HTTP transactions. The main IP is 191.37.224.208, located in Perolandia, Brazil and belongs to YZO TELECOM TECNOLOGIA EIRELI - ME, BR. The main domain is ticket.d36.com.br.
TLS certificate: Issued by R3 on September 19th 2022. Valid for: 3 months.

This is the only time ticket.d36.com.br was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 9	191.37.224.208 191.37.224.208	263374 (YZO TELEC...) (YZO TELECOM TECNOLOGIA EIRELI - ME)
2	2a00:1450:400... 2a00:1450:4001:813::2003	15169 (GOOGLE) (GOOGLE)
10	2

9 191.37.224.208 (Perolandia, Brazil) 1 redirects

ASN263374 (YZO TELECOM TECNOLOGIA EIRELI - ME, BR)
PTR: IP-208.244.37.191.mixtel.com.br

ticket.d36.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	d36.com.br 1 redirects ticket.d36.com.br	100 KB
2	gstatic.com fonts.gstatic.com	33 KB
10	2

	Domain	Requested by
9	ticket.d36.com.br	1 redirects ticket.d36.com.br
2	fonts.gstatic.com	ticket.d36.com.br
10	2

This site contains links to these domains. Also see Links.

Domain
www.faveohelpdesk.com

Subject Issuer	Validity	Valid
ticket.d36.com.br R3	`2022-09-19` - `2022-12-18`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-08-29` - `2022-11-21`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://ticket.d36.com.br/probe.php
Frame ID: AC876575492733E7013FFA66136CA291
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Faveo Freelancer v4.10.6

Page URL History Show full URLs

https://ticket.d36.com.br/ HTTP 302
https://ticket.d36.com.br/probe.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

10
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

133 kB
Transfer

341 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.faveohelpdesk.com/
Title: Faveo

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://ticket.d36.com.br/ HTTP 302
https://ticket.d36.com.br/probe.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request probe.php Show response
ticket.d36.com.br/
Redirect Chain

https://ticket.d36.com.br/
https://ticket.d36.com.br/probe.php

9 KB
2 KB

2957ms
2955ms

Document
text/html

191.37.224.208
ME

General

Check archive.org

Show headers Download Go to

Full URL: https://ticket.d36.com.br/probe.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 191.37.224.208 Perolandia, Brazil, ASN263374 (YZO TELECOM TECNOLOGIA EIRELI - ME, BR),
Reverse DNS: IP-208.244.37.191.mixtel.com.br
Software: openresty /
Resource Hash: db1392884b750655f51887d3d4e14c1132673f343be969d7d35e24aaac1873fd

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-length: 2332
content-type: text/html; charset=UTF-8
date: Mon, 19 Sep 2022 16:17:47 GMT
server: openresty
vary: Accept-Encoding
x-served-by: ticket.d36.com.br

Redirect headers

cache-control: no-cache, private
content-length: 386
content-type: text/html; charset=UTF-8
date: Mon, 19 Sep 2022 16:17:44 GMT
location: https://ticket.d36.com.br/probe.php
server: openresty
x-served-by: ticket.d36.com.br

GET
H2 200 faveo.png
ticket.d36.com.br/themes/default/common/images/installer/ 11 KB
11 KB 229ms
228ms Image
image/png 191.37.224.208
ME

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ticket.d36.com.br/themes/default/common/images/installer/faveo.png
Requested by: Host: ticket.d36.com.br
URL: https://ticket.d36.com.br/probe.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 191.37.224.208 Perolandia, Brazil, ASN263374 (YZO TELECOM TECNOLOGIA EIRELI - ME, BR),
Reverse DNS: IP-208.244.37.191.mixtel.com.br
Software: openresty /
Resource Hash: a13877c0bae5142480a3b8720d2eed52ab802f0a0e09d011429f260148d28f7b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ticket.d36.com.br/probe.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Mon, 19 Sep 2022 16:17:48 GMT
last-modified: Mon, 12 Sep 2022 11:40:43 GMT
server: openresty
etag: "2af0-5e8795d9fe4c0"
content-type: image/png
accept-ranges: bytes
content-length: 10992
x-served-by: ticket.d36.com.br

GET
H2 200 bootstrap.min.css
ticket.d36.com.br/themes/default/common/css/ 114 KB
19 KB 457ms
456ms Stylesheet
text/css 191.37.224.208
ME

General

Check archive.org

Show headers Download Go to

Full URL: https://ticket.d36.com.br/themes/default/common/css/bootstrap.min.css
Requested by: Host: ticket.d36.com.br
URL: https://ticket.d36.com.br/probe.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 191.37.224.208 Perolandia, Brazil, ASN263374 (YZO TELECOM TECNOLOGIA EIRELI - ME, BR),
Reverse DNS: IP-208.244.37.191.mixtel.com.br
Software: openresty /
Resource Hash: b12f71a75e25186ac3bfce4f5a2aa9d3ceff8dd0ffb0710c23c47a6a6e53454e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ticket.d36.com.br/probe.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Mon, 19 Sep 2022 16:17:48 GMT
content-encoding: gzip
last-modified: Mon, 12 Sep 2022 11:40:43 GMT
server: openresty
etag: "1c9ce-5e8795d9fe4c0-gzip"
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 19267
x-served-by: ticket.d36.com.br

GET
H2 200 load-styles.css
ticket.d36.com.br/themes/default/common/css/ 77 KB
34 KB 667ms
664ms Stylesheet
text/css 191.37.224.208
ME

General

Check archive.org

Show headers Download Go to

Full URL: https://ticket.d36.com.br/themes/default/common/css/load-styles.css
Requested by: Host: ticket.d36.com.br
URL: https://ticket.d36.com.br/probe.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 191.37.224.208 Perolandia, Brazil, ASN263374 (YZO TELECOM TECNOLOGIA EIRELI - ME, BR),
Reverse DNS: IP-208.244.37.191.mixtel.com.br
Software: openresty /
Resource Hash: 277e0f3e330c2ef394f843b22ee59dc7c8060d802bd50cf57f9ea4916667162f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ticket.d36.com.br/probe.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Mon, 19 Sep 2022 16:17:48 GMT
content-encoding: gzip
last-modified: Mon, 12 Sep 2022 11:40:43 GMT
server: openresty
etag: "132f6-5e8795d9fe4c0-gzip"
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
x-served-by: ticket.d36.com.br

GET
H2 200 css.css
ticket.d36.com.br/themes/default/common/css/ 2 KB
644 B 437ms
435ms Stylesheet
text/css 191.37.224.208
ME

General

Check archive.org

Show headers Download Go to

Full URL: https://ticket.d36.com.br/themes/default/common/css/css.css
Requested by: Host: ticket.d36.com.br
URL: https://ticket.d36.com.br/probe.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 191.37.224.208 Perolandia, Brazil, ASN263374 (YZO TELECOM TECNOLOGIA EIRELI - ME, BR),
Reverse DNS: IP-208.244.37.191.mixtel.com.br
Software: openresty /
Resource Hash: b6cafb77d911ac670905f3d33ea637d9c0a2f38f66e58fe5b9d34b3c0e36247d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ticket.d36.com.br/probe.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Mon, 19 Sep 2022 16:17:48 GMT
content-encoding: gzip
last-modified: Mon, 12 Sep 2022 11:40:43 GMT
server: openresty
etag: "61c-5e8795d9fe4c0-gzip"
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 445
x-served-by: ticket.d36.com.br

GET
H2 200 setup.css
ticket.d36.com.br/themes/default/common/css/ 8 KB
2 KB 438ms
435ms Stylesheet
text/css 191.37.224.208
ME

General

Check archive.org

Show headers Download Go to

Full URL: https://ticket.d36.com.br/themes/default/common/css/setup.css
Requested by: Host: ticket.d36.com.br
URL: https://ticket.d36.com.br/probe.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 191.37.224.208 Perolandia, Brazil, ASN263374 (YZO TELECOM TECNOLOGIA EIRELI - ME, BR),
Reverse DNS: IP-208.244.37.191.mixtel.com.br
Software: openresty /
Resource Hash: 6b0611205d13708e4eb019ef7ef3a0ef834992f6b74eef47f3d6fb94f9253f13

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ticket.d36.com.br/probe.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Mon, 19 Sep 2022 16:17:48 GMT
content-encoding: gzip
last-modified: Mon, 12 Sep 2022 11:40:43 GMT
server: openresty
etag: "210a-5e8795d9fe4c0-gzip"
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 1773
x-served-by: ticket.d36.com.br

GET
H2 200 probe-custom.css
ticket.d36.com.br/themes/default/common/css/ 678 B
544 B 667ms
665ms Stylesheet
text/css 191.37.224.208
ME

General

Check archive.org

Show headers Download Go to

Full URL: https://ticket.d36.com.br/themes/default/common/css/probe-custom.css
Requested by: Host: ticket.d36.com.br
URL: https://ticket.d36.com.br/probe.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 191.37.224.208 Perolandia, Brazil, ASN263374 (YZO TELECOM TECNOLOGIA EIRELI - ME, BR),
Reverse DNS: IP-208.244.37.191.mixtel.com.br
Software: openresty /
Resource Hash: 91d7316d1a45c4e4406e3f8055ed7b5b83eabfb3672a1996ab319765d9205707

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ticket.d36.com.br/probe.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Mon, 19 Sep 2022 16:17:48 GMT
content-encoding: gzip
last-modified: Mon, 12 Sep 2022 11:40:43 GMT
server: openresty
etag: "2a6-5e8795d9fe4c0-gzip"
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 345
x-served-by: ticket.d36.com.br

GET
H2 200 jquery-3.5.1.min.js Show response
ticket.d36.com.br/themes/default/common/plugins/jQuery/ 87 KB
30 KB 667ms
665ms Script
application/javascript 191.37.224.208
ME

General

Check archive.org

Show headers Download Go to

Full URL: https://ticket.d36.com.br/themes/default/common/plugins/jQuery/jquery-3.5.1.min.js
Requested by: Host: ticket.d36.com.br
URL: https://ticket.d36.com.br/probe.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 191.37.224.208 Perolandia, Brazil, ASN263374 (YZO TELECOM TECNOLOGIA EIRELI - ME, BR),
Reverse DNS: IP-208.244.37.191.mixtel.com.br
Software: openresty /
Resource Hash: 6150a35c0f486c46cadf0e230e2aa159c7c23ecfbb5611b64ee3f25fcbff341f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ticket.d36.com.br/probe.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Mon, 19 Sep 2022 16:17:48 GMT
content-encoding: gzip
last-modified: Mon, 12 Sep 2022 11:40:43 GMT
server: openresty
etag: "15d83-5e8795d9fe4c0-gzip"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 30908
x-served-by: ticket.d36.com.br

GET
H2 200 u-WUoqrET9fUeobQW7jkRZBw1xU1rKptJj_0jans920.woff2
fonts.gstatic.com/s/opensans/v13/ 16 KB
16 KB 133ms
50ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v13/u-WUoqrET9fUeobQW7jkRZBw1xU1rKptJj_0jans920.woff2

Requested by

Host: ticket.d36.com.br
URL: https://ticket.d36.com.br/themes/default/common/css/css.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

43640ab0efbdbd50a1162047c1f62f338fb84de407411b98bfa6a1f8666ef0af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ticket.d36.com.br/
Origin: https://ticket.d36.com.br
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sat, 17 Sep 2022 08:05:16 GMT
x-content-type-options: nosniff
age: 202352
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16644
x-xss-protection: 0
last-modified: Mon, 27 Apr 2015 23:45:14 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 17 Sep 2023 08:05:16 GMT

GET
H2 200 MTP_ySUJH_bn48VBG8sNSiYtBUPDK3WL7KRKS_3q7OE.woff2
fonts.gstatic.com/s/opensans/v13/ 16 KB
17 KB 121ms
39ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v13/MTP_ySUJH_bn48VBG8sNSiYtBUPDK3WL7KRKS_3q7OE.woff2

Requested by

Host: ticket.d36.com.br
URL: https://ticket.d36.com.br/themes/default/common/css/css.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5f618e89e47e6f94639b5c6c362a98808293fb532ad1aec3d4060aa1e262ac93

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ticket.d36.com.br/
Origin: https://ticket.d36.com.br
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 18 Sep 2022 19:25:39 GMT
x-content-type-options: nosniff
age: 75129
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16696
x-xss-protection: 0
last-modified: Mon, 27 Apr 2015 23:46:06 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 18 Sep 2023 19:25:39 GMT

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.gstatic.com
ticket.d36.com.br
191.37.224.208
2a00:1450:4001:813::2003
277e0f3e330c2ef394f843b22ee59dc7c8060d802bd50cf57f9ea4916667162f
43640ab0efbdbd50a1162047c1f62f338fb84de407411b98bfa6a1f8666ef0af
5f618e89e47e6f94639b5c6c362a98808293fb532ad1aec3d4060aa1e262ac93
6150a35c0f486c46cadf0e230e2aa159c7c23ecfbb5611b64ee3f25fcbff341f
6b0611205d13708e4eb019ef7ef3a0ef834992f6b74eef47f3d6fb94f9253f13
91d7316d1a45c4e4406e3f8055ed7b5b83eabfb3672a1996ab319765d9205707
a13877c0bae5142480a3b8720d2eed52ab802f0a0e09d011429f260148d28f7b
b12f71a75e25186ac3bfce4f5a2aa9d3ceff8dd0ffb0710c23c47a6a6e53454e
b6cafb77d911ac670905f3d33ea637d9c0a2f38f66e58fe5b9d34b3c0e36247d
db1392884b750655f51887d3d4e14c1132673f343be969d7d35e24aaac1873fd

ticket.d36.com.br Open in urlscan Pro 191.37.224.208 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

10 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

133 kBTransfer

341 kBSize

0 Cookies

1 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

0 Cookies

Indicators

ticket.d36.com.br Open in urlscan Pro
191.37.224.208 Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

133 kB
Transfer

341 kB
Size

0
Cookies

10 HTTP transactions
0 data transactions