165.140.10.2 Open in urlscan Pro
165.140.10.2 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://urddmtswaookolrarwmmyysi.blob.core.windows.net/oqshdqshdlq66666/2223.html#4bbkawxjlmd1147ycuif94mzkufoeavtbhav51dnvqxyzwkd7800167gprflsl2377jwq...
Effective URL:
http://165.140.10.2/rd/4bbkawxjlmd1147ycuif94mzkufoeavtbhav51dnvqxyzwkd7800167gprflsl2377jwqmwesgtxtdm16
Submission: On April 21 via api (April 21st 2023, 4:41:33 am UTC) from BE — Scanned from DE

Summary HTTP 3 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 3 HTTP transactions. The main IP is 165.140.10.2, located in United States and belongs to VISLOM, TR. The main domain is 165.140.10.2.

This is the only time 165.140.10.2 was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	20.60.132.4 20.60.132.4	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 2	165.140.10.2 165.140.10.2	210439 (VISLOM) (VISLOM)
1	185.197.30.13 185.197.30.13	63473 (HOSTHATCH) (HOSTHATCH)
3	3

1 20.60.132.4 (Boydton, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

urddmtswaookolrarwmmyysi.blob.core.windows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 165.140.10.2 (United States) 1 redirects

ASN210439 (VISLOM, TR)

165.140.10.2	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.197.30.13 (Los Angeles, United States)

ASN63473 (HOSTHATCH, US)
PTR: mail.loadsquared.com

www.kystnesybl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	kystnesybl.com www.kystnesybl.com	138 B
1	windows.net urddmtswaookolrarwmmyysi.blob.core.windows.net	557 B
3	2

	Domain	Requested by
1	www.kystnesybl.com	165.140.10.2
1	urddmtswaookolrarwmmyysi.blob.core.windows.net
3	2

This site contains no links.

Subject Issuer	Validity	Valid
*.blob.core.windows.net Microsoft RSA TLS CA 01	`2023-03-19` - `2024-03-19`	a year	crt.sh
www.kystnesybl.com R3	`2023-03-05` - `2023-06-03`	3 months	crt.sh

This page contains 1 frames:

Frame: https://www.kystnesybl.com/da6CpInfShYz_VQWWITmB3EbaSW1poPbAWxHQ63LqIt6KEVzuFRNOXU_4y5WJ7H7XwVAS5NQU2_798NgVyIJ6w~~/16/94-1147/51-7800167-2377
Frame ID: DAC465FE8202FD15155BE80138753713
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://urddmtswaookolrarwmmyysi.blob.core.windows.net/oqshdqshdlq66666/2223.html Page URL
http://165.140.10.2/rd/4bbkawxjlmd1147ycuif94mzkufoeavtbhav51dnvqxyzwkd7800167gprflsl2377jwqmwes... Page URL

Page Statistics

3
Requests

67 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

1 kB
Transfer

0 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://urddmtswaookolrarwmmyysi.blob.core.windows.net/oqshdqshdlq66666/2223.html Page URL
http://165.140.10.2/rd/4bbkawxjlmd1147ycuif94mzkufoeavtbhav51dnvqxyzwkd7800167gprflsl2377jwqmwesgtxtdm16 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

http://165.140.10.2/4bbkawxjlmd1147ycuif94mzkufoeavtbhav51dnvqxyzwkd7800167gprflsl2377jwqmwesgtxtdm16 HTTP 302
https://www.kystnesybl.com/da6CpInfShYz_VQWWITmB3EbaSW1poPbAWxHQ63LqIt6KEVzuFRNOXU_4y5WJ7H7XwVAS5NQU2_798NgVyIJ6w~~/16/94-1147/51-7800167-2377

3 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	2223.html urddmtswaookolrarwmmyysi.blob.core.windows.net/oqshdqshdlq66666/	154 B 557 B	739ms 104ms	Document text/html	20.60.132.4 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://urddmtswaookolrarwmmyysi.blob.core.windows.net/oqshdqshdlq66666/2223.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 20.60.132.4 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Content-Length 154 Content-MD5 zXfUG5HV7oRHRd/psNj3Vw== Content-Type text/html Date Fri, 21 Apr 2023 04:41:24 GMT ETag 0x8DB392A070E9755 Last-Modified Sun, 09 Apr 2023 18:41:27 GMT Server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-blob-type BlockBlob x-ms-lease-status unlocked x-ms-request-id 1d4a1fa7-401e-0039-420b-74b815000000 x-ms-version 2009-09-19
GET H/1.1	302 Found	Primary Request 4bbkawxjlmd1147ycuif94mzkufoeavtbhav51dnvqxyzwkd7800167gprflsl2377jwqmwesgtxtdm16 165.140.10.2/rd/	231 B 488 B	86ms 43ms	Document text/html	165.140.10.2 VISLOM
General Check archive.org Show headers Download Go to Full URL http://165.140.10.2/rd/4bbkawxjlmd1147ycuif94mzkufoeavtbhav51dnvqxyzwkd7800167gprflsl2377jwqmwesgtxtdm16 Requested by Host: urddmtswaookolrarwmmyysi.blob.core.windows.net URL: https://urddmtswaookolrarwmmyysi.blob.core.windows.net/oqshdqshdlq66666/2223.html Protocol HTTP/1.1 Server 165.140.10.2 , United States, ASN210439 (VISLOM, TR), Reverse DNS Software / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Content-Length 231 Content-Type text/html; charset=utf-8 Date Fri, 21 Apr 2023 04:41:25 GMT X-Address gin_throttle_mw_360000000000_185.213.155.163 X-Ratelimit-Limit 10 X-Ratelimit-Remaining 7 X-Ratelimit-Reset 1682055570
GET H/1.1	404 Not Found	51-7800167-2377 Show response www.kystnesybl.com/da6CpInfShYz_VQWWITmB3EbaSW1poPbAWxHQ63LqIt6KEVzuFRNOXU_4y5WJ7H7XwVAS5NQU2_798NgVyIJ6w~~/16/94-1147/ Redirect Chain http://165.140.10.2/4bbkawxjlmd1147ycuif94mzkufoeavtbhav51dnvqxyzwkd7800167gprflsl2377jwqmwesgtxtdm16 https://www.kystnesybl.com/da6CpInfShYz_VQWWITmB3EbaSW1poPbAWxHQ63LqIt6KEVzuFRNOXU_4y5WJ7H7XwVAS5NQU2_798NgVyIJ6w~~/16/94-1147/51-7800167-2377	0 138 B	1087ms 381ms	Document text/html	185.197.30.13 HOSTHATCH
General Check archive.org Show headers Download Go to Full URL https://www.kystnesybl.com/da6CpInfShYz_VQWWITmB3EbaSW1poPbAWxHQ63LqIt6KEVzuFRNOXU_4y5WJ7H7XwVAS5NQU2_798NgVyIJ6w~~/16/94-1147/51-7800167-2377 Requested by Host: 165.140.10.2 URL: http://165.140.10.2/rd/4bbkawxjlmd1147ycuif94mzkufoeavtbhav51dnvqxyzwkd7800167gprflsl2377jwqmwesgtxtdm16 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.197.30.13 Los Angeles, United States, ASN63473 (HOSTHATCH, US), Reverse DNS mail.loadsquared.com Software Apache / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer http://165.140.10.2/rd/4bbkawxjlmd1147ycuif94mzkufoeavtbhav51dnvqxyzwkd7800167gprflsl2377jwqmwesgtxtdm16 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Content-Length 0 Content-Type text/html; charset=UTF-8 Date Fri, 21 Apr 2023 04:41:28 GMT Server Apache Redirect headers Content-Length 165 Content-Type text/html; charset=utf-8 Date Fri, 21 Apr 2023 04:41:27 GMT Location https://www.kystnesybl.com/da6CpInfShYz_VQWWITmB3EbaSW1poPbAWxHQ63LqIt6KEVzuFRNOXU_4y5WJ7H7XwVAS5NQU2_798NgVyIJ6w~~/16/94-1147/51-7800167-2377 X-Address gin_throttle_mw_360000000000_185.213.155.163 X-Ratelimit-Limit 10 X-Ratelimit-Remaining 6 X-Ratelimit-Reset 1682055570

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.kystnesybl.com/da6CpInfShYz_VQWWITmB3EbaSW1poPbAWxHQ63LqIt6KEVzuFRNOXU_4y5WJ7H7XwVAS5NQU2_798NgVyIJ6w~~/16/94-1147/51-7800167-2377 Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

urddmtswaookolrarwmmyysi.blob.core.windows.net
www.kystnesybl.com
165.140.10.2
185.197.30.13
20.60.132.4
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

165.140.10.2 Open in urlscan Pro 165.140.10.2 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

3 Requests

67 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

1 Countries

1 kBTransfer

0 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

165.140.10.2 Open in urlscan Pro
165.140.10.2 Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

67 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

1 kB
Transfer

0 kB
Size

0
Cookies

3 HTTP transactions
0 data transactions