www.bfst.xyz Open in urlscan Pro
2606:4700:3031::ac43:dbcc Public Scan

Go To Rescan
Add Verdict Report

URL:
http://www.bfst.xyz/three.php
Submission: On September 14 via manual (September 14th 2020, 5:35:43 pm UTC) from US

Summary HTTP 17 Redirects Behaviour Indicators

Summary

This website contacted 12 IPs in 6 countries across 10 domains to perform 17 HTTP transactions. The main IP is 2606:4700:3031::ac43:dbcc, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.bfst.xyz.

This is the only time www.bfst.xyz was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	2606:4700:303... 2606:4700:3031::ac43:dbcc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	192.243.59.12 192.243.59.12	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
4	2a04:4e42:1b:... 2a04:4e42:1b::621	54113 (FASTLY) (FASTLY)
1	2606:4700:20:... 2606:4700:20::ac43:4739	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	2001:470:1f0a... 2001:470:1f0a:716::2	6939 (HURRICANE) (HURRICANE)
2	2606:4700::68... 2606:4700::6811:c46b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	46.105.201.240 46.105.201.240	16276 (OVH) (OVH)
1	192.99.0.58 192.99.0.58	16276 (OVH) (OVH)
1	2606:4700:303... 2606:4700:3034::6812:3647	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	2a00:1a28:151... 2a00:1a28:1510:9::5271	42708 (PORTLANE ...) (PORTLANE www.portlane.com)
1	35.190.71.96 35.190.71.96	15169 (GOOGLE) (GOOGLE)
17	12

1 2606:4700:3031::ac43:dbcc (United States)

ASN13335 (CLOUDFLARENET, US)

www.bfst.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.243.59.12 (Ashburn, United States)

ASN39572 (ADVANCEDHOSTERS-AS, NL)

zlsvr3xybeh4.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a04:4e42:1b::621 (Ascension Island)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::ac43:4739 (United States)

ASN13335 (CLOUDFLARENET, US)

waust.at	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:470:1f0a:716::2 (Russian Federation) 1 redirects

ASN6939 (HURRICANE, US)

livecounter.theyosh.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:c46b (United States)

ASN13335 (CLOUDFLARENET, US)

celeritascdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 46.105.201.240 (France)

ASN16276 (OVH, FR)

s10.histats.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.99.0.58 (Montreal, Canada)

ASN16276 (OVH, FR)
PTR: ns500326.ip-192-99-0.net

s4.histats.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3034::6812:3647 (United States)

ASN13335 (CLOUDFLARENET, US)

ufpcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1a28:1510:9::5271 (Stockholm, Sweden) 1 redirects

ASN42708 (PORTLANE www.portlane.com, SE)

cdn.livecounter.theyosh.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.71.96 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 96.71.190.35.bc.googleusercontent.com

onclickgenius.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	theyosh.nl 2 redirects livecounter.theyosh.nl cdn.livecounter.theyosh.nl	1 KB
4	jsdelivr.net cdn.jsdelivr.net	160 KB
2	histats.com s10.histats.com s4.histats.com	5 KB
2	celeritascdn.com celeritascdn.com	21 KB
1	onclickgenius.com onclickgenius.com	132 B
1	ufpcdn.com ufpcdn.com
1	waust.at waust.at	8 KB
1	zlsvr3xybeh4.com zlsvr3xybeh4.com
1	bfst.xyz www.bfst.xyz	119 KB
0	Failed function sub() { [native code] }. Failed
17	10

	Domain	Requested by
4	cdn.jsdelivr.net	www.bfst.xyz
2	cdn.livecounter.theyosh.nl	1 redirects livecounter.theyosh.nl
2	celeritascdn.com	www.bfst.xyz
2	livecounter.theyosh.nl	1 redirects www.bfst.xyz
1	onclickgenius.com	www.bfst.xyz
1	ufpcdn.com	www.bfst.xyz
1	s4.histats.com	s10.histats.com
1	s10.histats.com	www.bfst.xyz
1	waust.at	www.bfst.xyz
1	zlsvr3xybeh4.com	www.bfst.xyz
1	www.bfst.xyz
0	34.120.6.95 Failed	cdn.jsdelivr.net
17	12

This site contains no links.

Subject Issuer	Validity	Valid
f3.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2020-08-17` - `2021-04-17`	8 months	crt.sh
theyosh.nl Let's Encrypt Authority X3	`2020-09-12` - `2020-12-11`	3 months	crt.sh
histats.com Let's Encrypt Authority X3	`2020-09-08` - `2020-12-07`	3 months	crt.sh
cdn.livecounter.theyosh.nl Let's Encrypt Authority X3	`2020-09-10` - `2020-12-09`	3 months	crt.sh

This page contains 3 frames:

Primary Page: http://www.bfst.xyz/three.php
Frame ID: E9801C056A0112F45BADA404D1A30E36
Requests: 15 HTTP requests in this frame

Frame: http://ufpcdn.com/script/identify.html?frmt=0
Frame ID: 23A1F6BB714BDF52D8711844C0B8E35D
Requests: 1 HTTP requests in this frame

Frame: https://cdn.livecounter.theyosh.nl/8935.html
Frame ID: 9FB17AE028CE08EE229F54C905450B8F
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

17
Requests

41 %
HTTPS

64 %
IPv6

10
Domains

12
Subdomains

12
IPs

6
Countries

313 kB
Transfer

1048 kB
Size

9
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 6

http://livecounter.theyosh.nl/8935.js HTTP 301
https://livecounter.theyosh.nl/8935.js

Request Chain 12

http://cdn.livecounter.theyosh.nl/8935.html HTTP 301
https://cdn.livecounter.theyosh.nl/8935.html

17 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set three.php Show response
www.bfst.xyz/ 340 KB
119 KB 90ms
55ms Document
text/html 2606:4700:3031::ac43:dbcc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://www.bfst.xyz/three.php
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dbcc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 971209ca828f44ff529a610121f526a509378e927862d389f3ef65557cbc9e62

Request headers

Host: www.bfst.xyz
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 14 Sep 2020 17:35:24 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=dbf5121dc9da350e96e67b5b0ce93af391600104924; expires=Wed, 14-Oct-20 17:35:24 GMT; path=/; domain=.bfst.xyz; HttpOnly; SameSite=Lax
Vary: Accept-Encoding Accept-Encoding
X-Turbo-Charged-By: LiteSpeed
G7Cache-10G: HIT
CF-Cache-Status: DYNAMIC
cf-request-id: 052f489bd3000005bbceafd200000001
Server: cloudflare
CF-RAY: 5d2bdd3fbdda05bb-FRA
Content-Encoding: gzip

GET
H/1.1 403
Forbidden 7028b257c6702101190fa525b7cc585c.js
zlsvr3xybeh4.com/70/28/b2/ 0
0 214ms
191ms Script
application/javascript 192.243.59.12
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://zlsvr3xybeh4.com/70/28/b2/7028b257c6702101190fa525b7cc585c.js
Requested by: Host: www.bfst.xyz
URL: http://www.bfst.xyz/three.php
Protocol: HTTP/1.1
Server: 192.243.59.12 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.17.6 /
Resource Hash

Request headers

Referer: http://www.bfst.xyz/three.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Access-Control-Allow-Origin: *
Date: Mon, 14 Sep 2020 17:35:24 GMT
Server: nginx/1.17.6
Connection: keep-alive
Content-Type: application/javascript
Content-Length: 0
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

GET
H2 200 clappr.min.js Show response
cdn.jsdelivr.net/clappr/latest/ 517 KB
127 KB 27ms
9ms Script
application/javascript 2a04:4e42:1b::621
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/clappr/latest/clappr.min.js

Requested by

Host: www.bfst.xyz
URL: http://www.bfst.xyz/three.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::621 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

cbcf0e85e906f9e8caf296fc6fd0cb8fcfb69b31e9ac570d63bd837fcf743f6f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://www.bfst.xyz/three.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 3853487
x-cache: HIT, HIT
status: 200
content-length: 129736
etag: W/"8156e-D6xFiaxzMytsrOCcfMOmYtKY+qo"
x-served-by: cache-fra19146-FRA, cache-hhn4046-HHN
date: Mon, 14 Sep 2020 17:35:24 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 level-selector.min.js Show response
cdn.jsdelivr.net/clappr.level-selector/latest/ 9 KB
3 KB 27ms
9ms Script
application/javascript 2a04:4e42:1b::621
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/clappr.level-selector/latest/level-selector.min.js

Requested by

Host: www.bfst.xyz
URL: http://www.bfst.xyz/three.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::621 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

23a715a6d8a35921f8c02eab19a93b6c9c42271ecfccbde0005476959e2edff9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://www.bfst.xyz/three.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 4070021
x-cache: HIT, HIT
status: 200
content-length: 3061
etag: W/"2524-9Cxz5uiSAcz1rVE5FbtBguw6QQw"
x-served-by: cache-fra19151-FRA, cache-hhn4046-HHN
date: Mon, 14 Sep 2020 17:35:24 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 hlsjs-p2p-engine.min.js Show response
cdn.jsdelivr.net/npm/cdnbye@latest/dist/ 97 KB
29 KB 26ms
9ms Script
application/javascript 2a04:4e42:1b::621
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/cdnbye@latest/dist/hlsjs-p2p-engine.min.js

Requested by

Host: www.bfst.xyz
URL: http://www.bfst.xyz/three.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::621 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

0f76df6bb307955ce89552dc6f082e9c9401254f5df8423a19e3732a241e5240

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://www.bfst.xyz/three.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 7360
x-cache: HIT, HIT
status: 200
cross-origin-resource-policy: cross-origin
content-length: 29166
etag: W/"18590-dNF82QEWh8BeCLa19Ms5T507mJg"
x-served-by: cache-fra19167-FRA, cache-hhn4046-HHN
date: Mon, 14 Sep 2020 17:35:24 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 clappr-plugin.min.js Show response
cdn.jsdelivr.net/npm/cdnbye@latest/dist/ 3 KB
1 KB 26ms
8ms Script
application/javascript 2a04:4e42:1b::621
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/cdnbye@latest/dist/clappr-plugin.min.js

Requested by

Host: www.bfst.xyz
URL: http://www.bfst.xyz/three.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::621 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

75bd806cedfbb8345056d85741118c48d3d54b910410e9845a4f8d5073eeb558

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://www.bfst.xyz/three.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 15051
x-cache: HIT, HIT
status: 200
cross-origin-resource-policy: cross-origin
content-length: 1137
etag: W/"b7a-xrHVogjSh9UgCA6avhjMzbTd9uk"
x-served-by: cache-fra19126-FRA, cache-hhn4046-HHN
date: Mon, 14 Sep 2020 17:35:24 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H/1.1 200
OK d.js Show response
waust.at/ 13 KB
8 KB 18ms
12ms Script
application/x-javascript 2606:4700:20::ac43:4739
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://waust.at/d.js
Requested by: Host: www.bfst.xyz
URL: http://www.bfst.xyz/three.php
Protocol: HTTP/1.1
Server: 2606:4700:20::ac43:4739 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: efa8c2057af08d12b4e74599705c6e88f36bda5f4ec712fe58d1286a159fcfa6

Request headers

Referer: http://www.bfst.xyz/three.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 14 Sep 2020 17:35:24 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
Age: 2236
Transfer-Encoding: chunked
Connection: keep-alive
cf-request-id: 052f489d330000975a0f3d7200000001
Last-Modified: Tue, 08 Sep 2020 20:50:44 GMT
Server: cloudflare
ETag: W/"5f57eea4-33b6"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
CF-RAY: 5d2bdd41ef58975a-FRA
Expires: Tue, 15 Sep 2020 16:58:08 GMT

GET
H2

200

8935.js Show response
livecounter.theyosh.nl/
Redirect Chain

http://livecounter.theyosh.nl/8935.js
https://livecounter.theyosh.nl/8935.js

374 B
435 B

150ms
50ms

Script
application/javascript

2001:470:1f0a:716::2
HURRICANE

General

Check archive.org

Show headers Download Go to

Full URL

https://livecounter.theyosh.nl/8935.js

Requested by

Host: www.bfst.xyz
URL: http://www.bfst.xyz/three.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2001:470:1f0a:716::2 , Russian Federation, ASN6939 (HURRICANE, US),

Reverse DNS

Software

nginx /

Resource Hash

d39584af654bfe9668855dc03d0b61cc679a56b3c2648e5fe54c5e1c544d78f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: http://www.bfst.xyz/three.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-version: LUA:1.0
date: Mon, 14 Sep 2020 17:35:24 GMT
content-encoding: gzip
server: nginx
status: 200
strict-transport-security: max-age=15768000
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=691200
expires: Tue, 22 Sep 2020 17:35:24 GMT

Redirect headers

X-Version: LUA:1.0
Date: Mon, 14 Sep 2020 17:35:24 GMT
Server: nginx
Location: https://livecounter.theyosh.nl/8935.js
Strict-Transport-Security: max-age=15768000
Content-Type: text/html
Access-Control-Allow-Origin: *
Connection: keep-alive
Keep-Alive: timeout=2
Content-Length: 162

GET
H/1.1 200
OK compatibility.js Show response
celeritascdn.com/script/ 20 KB
8 KB 35ms
23ms Script
application/javascript 2606:4700::6811:c46b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://celeritascdn.com/script/compatibility.js
Requested by: Host: www.bfst.xyz
URL: http://www.bfst.xyz/three.php
Protocol: HTTP/1.1
Server: 2606:4700::6811:c46b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6934fd0acb576bd75f065f4e657d0d4b13dbc024608cdd299c631c2fe33f47e2

Request headers

Referer: http://www.bfst.xyz/three.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 14 Sep 2020 17:35:24 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
Age: 2584
X-GUploader-UploadID: AAANsUlrAFUEc2OGMr7fhrAef1AN2iNMUrb8Kq4RIr_nVIJo5rpJ6cI0nrKSolkSsLvXztcFLsi3_hi2gF75VQQGv6w
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
Connection: keep-alive
Content-Type: application/javascript
cf-request-id: 052f489d5c00000621b192a200000001
Last-Modified: Wed, 08 Jul 2020 14:35:57 GMT
Server: cloudflare
ETag: W/"06fdd2e5df00d5a51bae7e42a3f19a23"
Vary: Accept-Encoding
x-goog-hash: crc32c=SErtPA==, md5=Bv3S5d8A1aUbrn5Co/GaIw==
x-goog-generation: 1594218957652935
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=14400
Transfer-Encoding: chunked
x-goog-stored-content-length: 20454
CF-RAY: 5d2bdd422f810621-FRA
Expires: Mon, 14 Sep 2020 21:35:24 GMT

GET
H/1.1 200
OK js15_as.js Show response
s10.histats.com/ 11 KB
5 KB 29ms
17ms Script
text/javascript 46.105.201.240
OVH

General

Check archive.org

Show headers Download Go to

Full URL: http://s10.histats.com/js15_as.js
Requested by: Host: www.bfst.xyz
URL: http://www.bfst.xyz/three.php
Protocol: HTTP/1.1
Server: 46.105.201.240 , France, ASN16276 (OVH, FR),
Reverse DNS
Software: /
Resource Hash: 2defe59e357a7d0683c8283ac42841db404a0884cae2eaecebf4b676e559dede

Request headers

Referer: http://www.bfst.xyz/three.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 14 Sep 2020 17:29:15 GMT
Content-Encoding: gzip
Last-Modified: Thu, 16 Apr 2020 10:44:16 GMT
X-CDN-Pop-IP: 137.74.120.32/27
ETag: "-375139978"
X-Cacheable: Matched cache
Vary: Accept-Encoding
X-IPLB-Instance: 32123
Content-Type: text/javascript
X-CDN-Pop: sbg
Accept-Ranges: bytes
Content-Length: 4547
X-Request-ID: 344196313

GET
H/1.1 200
OK 0.php Show response
s4.histats.com/stats/ 52 B
323 B 288ms
96ms Script
text/html 192.99.0.58
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://s4.histats.com/stats/0.php?4275943&@f16&@g1&@h1&@i1&@j1600104924565&@k0&@l1&@m&@n0&@o1000&@q0&@r0&@s0&@ten-US&@u1600&@b1:81863002&@b3:1600104925&@b4:js15_as.js&@b5:120&@a-_0.2.1&@vhttp%3A%2F%2Fwww.bfst.xyz%2Fthree.php&@w
Requested by: Host: s10.histats.com
URL: http://s10.histats.com/js15_as.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.99.0.58 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS: ns500326.ip-192-99-0.net
Software: /
Resource Hash: 23b213f23561483cff9517b14cc5cb31d653c341922978382264d5de364b0dcd

Request headers

Referer: http://www.bfst.xyz/three.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 14 Sep 2020 17:35:24 GMT
Connection: close
Content-Length: 52
Content-Type: text/html;charset=UTF-8

GET index.m3u8
34.120.6.95/live/c/ 0
0

GET
H/1.1 200
OK Cookie set identify.html
ufpcdn.com/script/ Frame 23A1 0
0 203ms
196ms Document
text/html 2606:4700:3034::6812:3647
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://ufpcdn.com/script/identify.html?frmt=0
Requested by: Host: www.bfst.xyz
URL: http://www.bfst.xyz/three.php
Protocol: HTTP/1.1
Server: 2606:4700:3034::6812:3647 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Host: ufpcdn.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://www.bfst.xyz/three.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://www.bfst.xyz/three.php

Response headers

Date: Mon, 14 Sep 2020 17:35:24 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d44dba4ca63df865b9501c8c6fd6ff8031600104924; expires=Wed, 14-Oct-20 17:35:24 GMT; path=/; domain=.ufpcdn.com; HttpOnly; SameSite=Lax __cf_bm=f242477a4f39a9dadef1facf653f48e62b49734c-1600104924-1800-AbcdbFGWmQLXFlMSUe0gyaVElX1vlIxGyoC8QDa+uftNLTZIFl69zpA7eAStz0wXMqz1Hv2xkhuO3n5ul+M9AYI=; path=/; expires=Mon, 14-Sep-20 18:05:24 GMT; domain=.ufpcdn.com; HttpOnly; SameSite=None
Last-Modified: Tue, 15 May 2018 06:39:25 GMT
CF-Cache-Status: DYNAMIC
cf-request-id: 052f489dae00001f3db6028200000001
Server: cloudflare
CF-RAY: 5d2bdd42bebe1f3d-FRA
Content-Encoding: gzip

GET
H2

200

8935.html
cdn.livecounter.theyosh.nl/ Frame 9FB1
Redirect Chain

http://cdn.livecounter.theyosh.nl/8935.html
https://cdn.livecounter.theyosh.nl/8935.html

0
0

99ms
32ms

Document
text/html

2a00:1a28:1510:9::5271
PORTLANE www.port...

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.livecounter.theyosh.nl/8935.html

Requested by

Host: livecounter.theyosh.nl
URL: http://livecounter.theyosh.nl/8935.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a00:1a28:1510:9::5271 Stockholm, Sweden, ASN42708 (PORTLANE www.portlane.com, SE),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

:method: GET
:authority: cdn.livecounter.theyosh.nl
:scheme: https
:path: /8935.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://www.bfst.xyz/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://www.bfst.xyz/

Response headers

status: 200
server: nginx
date: Mon, 14 Sep 2020 17:35:24 GMT
content-type: text/html; charset=utf-8
expires: Tue, 22 Sep 2020 10:00:07 GMT
cache-control: max-age=691200
x-version: LUA:1.0
access-control-allow-origin: *
strict-transport-security: max-age=15768000
x-content-type-options: nosniff
x-xss-protection: 1
referrer-policy: strict-origin-when-cross-origin
content-encoding: gzip

Redirect headers

Server: nginx
Date: Mon, 14 Sep 2020 17:35:24 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Location: https://cdn.livecounter.theyosh.nl/8935.html
Strict-Transport-Security: max-age=15768000
X-Content-Type-Options: nosniff
X-XSS-Protection: 1
Referrer-Policy: strict-origin-when-cross-origin

GET
H/1.1 204
No Content suurl.php Show response
onclickgenius.com/script/ 0
132 B 135ms
127ms Script
text/plain 35.190.71.96
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: http://onclickgenius.com/script/suurl.php?r=2466091&cbrandom=0.1664474268800693&cbiframe=0&cbWidth=1600&cbHeight=1200&cbtitle=&cbref=&cbdescription=&cbkeywords=&cbcdn=celeritascdn.com
Requested by: Host: www.bfst.xyz
URL: http://www.bfst.xyz/three.php
Protocol: HTTP/1.1
Server: 35.190.71.96 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 96.71.190.35.bc.googleusercontent.com
Software: openresty /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://www.bfst.xyz/three.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Mon, 14 Sep 2020 17:35:24 GMT
Via: 1.1 google
Server: openresty

GET
H/1.1 200
OK chrome.js Show response
celeritascdn.com/script/ 36 KB
12 KB 14ms
13ms Script
application/javascript 2606:4700::6811:c46b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://celeritascdn.com/script/chrome.js
Requested by: Host: www.bfst.xyz
URL: http://www.bfst.xyz/three.php
Protocol: HTTP/1.1
Server: 2606:4700::6811:c46b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 59f4d7efe6da31323c45da80772acec8cd177a21530c2de576f86ee3fcefd946

Request headers

Referer: http://www.bfst.xyz/three.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 14 Sep 2020 17:35:24 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
Age: 2623
X-GUploader-UploadID: ABg5-UzjdAhGvQK2XT7EqUMQ0h8TtggLA284hfvePTwegnuGVGTu-5C9Tv5kRLeA57rkuqI3C-TTPniuONITlOrjN9fAqlU3Sg
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
Connection: keep-alive
Content-Type: application/javascript
cf-request-id: 052f489e7000000621b1951200000001
Last-Modified: Mon, 14 Sep 2020 09:15:29 GMT
Server: cloudflare
ETag: W/"ef6565ab259dafbc08468b4d0bb46762"
Vary: Accept-Encoding
x-goog-hash: crc32c=KoLUvQ==, md5=72VlqyWdr7wIRotNC7RnYg==
x-goog-generation: 1600074929755781
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=14400
Transfer-Encoding: chunked
x-goog-stored-content-length: 37300
CF-RAY: 5d2bdd43eca40621-FRA
Expires: Mon, 14 Sep 2020 21:35:24 GMT

GET index.m3u8
34.120.6.95/live/c/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: 34.120.6.95
URL: http://34.120.6.95/live/c/index.m3u8

Domain: 34.120.6.95
URL: http://34.120.6.95/live/c/index.m3u8

Verdicts & Comments Add Verdict or Comment

58 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

9 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.bfst.xyz/	1970-01-19 13:54:48	Name: adcashufpv3 Value: 1971467110435915751673101291
www.bfst.xyz/	1970-01-19 21:14:00	Name: HstPt4275943 Value: 1
www.bfst.xyz/	1970-01-19 21:14:00	Name: HstCnv4275943 Value: 1
www.bfst.xyz/	1970-01-19 21:14:00	Name: HstCla4275943 Value: 1600104924565
www.bfst.xyz/	1970-01-19 21:14:00	Name: HstCns4275943 Value: 1
www.bfst.xyz/	1970-01-19 21:14:00	Name: HstCmu4275943 Value: 1600104924565
www.bfst.xyz/	1970-01-19 21:14:00	Name: HstPn4275943 Value: 1
www.bfst.xyz/	1970-01-19 21:14:00	Name: HstCfa4275943 Value: 1600104924565
.bfst.xyz/	1970-01-19 13:11:36	Name: __cfduid Value: dbf5121dc9da350e96e67b5b0ce93af391600104924

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

34.120.6.95
cdn.jsdelivr.net
cdn.livecounter.theyosh.nl
celeritascdn.com
livecounter.theyosh.nl
onclickgenius.com
s10.histats.com
s4.histats.com
ufpcdn.com
waust.at
www.bfst.xyz
zlsvr3xybeh4.com
34.120.6.95
192.243.59.12
192.99.0.58
2001:470:1f0a:716::2
2606:4700:20::ac43:4739
2606:4700:3031::ac43:dbcc
2606:4700:3034::6812:3647
2606:4700::6811:c46b
2a00:1a28:1510:9::5271
2a04:4e42:1b::621
35.190.71.96
46.105.201.240
0f76df6bb307955ce89552dc6f082e9c9401254f5df8423a19e3732a241e5240
23a715a6d8a35921f8c02eab19a93b6c9c42271ecfccbde0005476959e2edff9
23b213f23561483cff9517b14cc5cb31d653c341922978382264d5de364b0dcd
2defe59e357a7d0683c8283ac42841db404a0884cae2eaecebf4b676e559dede
59f4d7efe6da31323c45da80772acec8cd177a21530c2de576f86ee3fcefd946
6934fd0acb576bd75f065f4e657d0d4b13dbc024608cdd299c631c2fe33f47e2
75bd806cedfbb8345056d85741118c48d3d54b910410e9845a4f8d5073eeb558
971209ca828f44ff529a610121f526a509378e927862d389f3ef65557cbc9e62
cbcf0e85e906f9e8caf296fc6fd0cb8fcfb69b31e9ac570d63bd837fcf743f6f
d39584af654bfe9668855dc03d0b61cc679a56b3c2648e5fe54c5e1c544d78f8
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
efa8c2057af08d12b4e74599705c6e88f36bda5f4ec712fe58d1286a159fcfa6

www.bfst.xyz Open in urlscan Pro 2606:4700:3031::ac43:dbcc Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

17 Requests

41 %HTTPS

64 %IPv6

10 Domains

12 Subdomains

12 IPs

6 Countries

313 kBTransfer

1048 kBSize

9 Cookies

0 Outgoing links

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

58 JavaScript Global Variables

9 Cookies

Indicators

www.bfst.xyz Open in urlscan Pro
2606:4700:3031::ac43:dbcc Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

41 %
HTTPS

64 %
IPv6

10
Domains

12
Subdomains

12
IPs

6
Countries

313 kB
Transfer

1048 kB
Size

9
Cookies

17 HTTP transactions
0 data transactions