Submitted URL: https://globalshiping.com.tr/_notes/entice.php?BankStatement=EgxAQAtsSAFDXgsBSQBfAgZDHA==
Effective URL: https://sodrabohuslan.com/?BankStatement=hello@doorsteps.com
Submission: On October 18 via manual from IN — Scanned from DE

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 3 HTTP transactions. The main IP is 212.73.25.130, located in Ronninge, Sweden and belongs to TELENOR-NEXTEL Telenor Norge AS, NO. The main domain is sodrabohuslan.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on September 17th 2020. Valid for: a year.
This is the only time sodrabohuslan.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 185.71.216.114 43260 (AS43260)
1 212.73.25.130 2119 (TELENOR-N...)
3 2
Apex Domain
Subdomains
Transfer
2 globalshiping.com.tr
globalshiping.com.tr
1 KB
1 sodrabohuslan.com
sodrabohuslan.com
414 B
3 2
Domain Requested by
2 globalshiping.com.tr globalshiping.com.tr
1 sodrabohuslan.com
3 2

This site contains no links.

Subject Issuer Validity Valid
globalshiping.com.tr
R3
2022-09-19 -
2022-12-18
3 months crt.sh
*.optisign.se
Sectigo RSA Domain Validation Secure Server CA
2020-09-17 -
2021-10-18
a year crt.sh

This page contains 1 frames:

Primary Page: https://sodrabohuslan.com/?BankStatement=hello@doorsteps.com
Frame ID: 71B0C1353CFE78758BC781E9C5AD24F8
Requests: 3 HTTP requests in this frame

Screenshot

Page Title

Not Found

Page URL History Show full URLs

  1. https://globalshiping.com.tr/_notes/entice.php?BankStatement=EgxAQAtsSAFDXgsBSQBfAgZDHA== Page URL
  2. https://globalshiping.com.tr/_notes/entice.php?BankStatement=EgxAQAtsSAFDXgsBSQBfAgZDHA== Page URL
  3. https://sodrabohuslan.com/?BankStatement=hello@doorsteps.com Page URL

Page Statistics

3
Requests

67 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

2 kB
Transfer

2 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://globalshiping.com.tr/_notes/entice.php?BankStatement=EgxAQAtsSAFDXgsBSQBfAgZDHA== Page URL
  2. https://globalshiping.com.tr/_notes/entice.php?BankStatement=EgxAQAtsSAFDXgsBSQBfAgZDHA== Page URL
  3. https://sodrabohuslan.com/?BankStatement=hello@doorsteps.com Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
entice.php
globalshiping.com.tr/_notes/
937 B
689 B
Document
General
Full URL
https://globalshiping.com.tr/_notes/entice.php?BankStatement=EgxAQAtsSAFDXgsBSQBfAgZDHA==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.71.216.114 , Cyprus, ASN43260 (AS43260, TR),
Reverse DNS
18571216114.static.turkishost.com
Software
/ PHP/5.6.40
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding
br
content-length
434
content-type
text/html; charset=UTF-8
date
Tue, 18 Oct 2022 00:34:26 GMT
vary
Accept-Encoding
x-powered-by
PHP/5.6.40
entice.php
globalshiping.com.tr/_notes/
993 B
530 B
Document
General
Full URL
https://globalshiping.com.tr/_notes/entice.php?BankStatement=EgxAQAtsSAFDXgsBSQBfAgZDHA==
Requested by
Host: globalshiping.com.tr
URL: https://globalshiping.com.tr/_notes/entice.php?BankStatement=EgxAQAtsSAFDXgsBSQBfAgZDHA==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.71.216.114 , Cyprus, ASN43260 (AS43260, TR),
Reverse DNS
18571216114.static.turkishost.com
Software
/ PHP/5.6.40
Resource Hash

Request headers

Referer
https://globalshiping.com.tr/_notes/entice.php?BankStatement=EgxAQAtsSAFDXgsBSQBfAgZDHA==
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
br
content-length
492
content-type
text/html; charset=UTF-8
date
Tue, 18 Oct 2022 00:34:26 GMT
vary
Accept-Encoding
x-powered-by
PHP/5.6.40
Primary Request /
sodrabohuslan.com/
315 B
414 B
Document
General
Full URL
https://sodrabohuslan.com/?BankStatement=hello@doorsteps.com
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
212.73.25.130 Ronninge, Sweden, ASN2119 (TELENOR-NEXTEL Telenor Norge AS, NO),
Reverse DNS
www.psekonomiochledarskap.se
Software
Microsoft-HTTPAPI/2.0 /
Resource Hash
ce7127c38e30e92a021ed2bd09287713c6a923db9ffdb43f126e8965d777fbf0

Request headers

Referer
https://globalshiping.com.tr/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-length
315
content-type
text/html; charset=us-ascii
date
Tue, 18 Oct 2022 00:34:26 GMT
server
Microsoft-HTTPAPI/2.0

Verdicts & Comments Add Verdict or Comment

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation

2 Cookies

Domain/Path Name / Value
globalshiping.com.tr/ Name: d
Value: 0
globalshiping.com.tr/ Name: n
Value: Etc/Unknown

1 Console Messages

Source Level URL
Text
network error URL: https://sodrabohuslan.com/?BankStatement=hello@doorsteps.com
Message:
Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

globalshiping.com.tr
sodrabohuslan.com
185.71.216.114
212.73.25.130
ce7127c38e30e92a021ed2bd09287713c6a923db9ffdb43f126e8965d777fbf0