urlscan.io logo urlscan.io
SecurityTrails logo

chk-3yfb1.xyz Open in urlscan Pro
2606:4700:3030::6815:5c7c  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://updt644-serv1ce.info/
Effective URL: https://chk-3yfb1.xyz/HXFf4N/?click=5866959&flow=6636&land=lukoil_new
Submission: On August 26 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 2 HTTP transactions. The main IP is 2606:4700:3030::6815:5c7c, located in United States and belongs to CLOUDFLARENET, US. The main domain is chk-3yfb1.xyz.
TLS certificate: Issued by R3 on July 21st 2021. Valid for: 3 months.
This is the only time chk-3yfb1.xyz was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 87.251.86.26 212461 (NEMTCOV)
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
1 2606:4700:303... 13335 (CLOUDFLAR...)
2 2
Apex Domain
Subdomains		 Transfer
1 chk-3yfb1.xyz
chk-3yfb1.xyz
1 KB
1 3grbbdf647g.xyz
3grbbdf647g.xyz
665 B
1 updt644-serv1ce.info
updt644-serv1ce.info
440 B
2 3
Domain Requested by
1 chk-3yfb1.xyz
1 3grbbdf647g.xyz 1 redirects
1 updt644-serv1ce.info
2 3

This site contains no links.

Subject Issuer Validity Valid
*.chk-3yfb1.xyz
R3		 2021-07-21 -
2021-10-19		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://chk-3yfb1.xyz/HXFf4N/?click=5866959&flow=6636&land=lukoil_new
Frame ID: 9B8CE3B1EBABCFAC56ECBCB0B58B9FC5
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://updt644-serv1ce.info/ Page URL
  2. https://3grbbdf647g.xyz/redirect-luko-2/?flow=6636 HTTP 302
    https://chk-3yfb1.xyz/HXFf4N/?click=5866959&flow=6636&land=lukoil_new Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /php\/?([\d.]+)?/i
Overall confidence: 100%
Detected patterns
  • headers server /CentOS/i
Overall confidence: 100%
Detected patterns
  • headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

2
Requests

50 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

2 kB
Transfer

1 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://updt644-serv1ce.info/ Page URL
  2. https://3grbbdf647g.xyz/redirect-luko-2/?flow=6636 HTTP 302
    https://chk-3yfb1.xyz/HXFf4N/?click=5866959&flow=6636&land=lukoil_new Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
updt644-serv1ce.info/ 		114 B
440 B 		Document
General
Check archive.org
Download Go to
Full URL
http://updt644-serv1ce.info/
Protocol
HTTP/1.1
Server
87.251.86.26 , Russian Federation, ASN212461 (NEMTCOV, RU),
Reverse DNS
scdd.ru
Software
Apache/2.4.37 (centos) OpenSSL/1.1.1g mod_fcgid/2.3.9 PHP/7.2.24 /
Resource Hash
e79d7a19af2677fcf765b4eacd3b75ef42ff0cb7a8a66397d793085f56921296

Request headers

Host
updt644-serv1ce.info
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Thu, 26 Aug 2021 16:24:00 GMT
Server
Apache/2.4.37 (centos) OpenSSL/1.1.1g mod_fcgid/2.3.9 PHP/7.2.24
Last-Modified
Thu, 26 Aug 2021 06:33:49 GMT
ETag
"72-5ca708cb05a42"
Accept-Ranges
bytes
Content-Length
114
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html
Primary Request /
chk-3yfb1.xyz/HXFf4N/
Redirect Chain
  • https://3grbbdf647g.xyz/redirect-luko-2/?flow=6636
  • https://chk-3yfb1.xyz/HXFf4N/?click=5866959&flow=6636&land=lukoil_new
690 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://chk-3yfb1.xyz/HXFf4N/?click=5866959&flow=6636&land=lukoil_new
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::6815:5c7c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
32016daae0eaad16378cdc111722f7d2bbb302b2c4510b9ce6717038ed0350f1

Request headers

:method
GET
:authority
chk-3yfb1.xyz
:scheme
https
:path
/HXFf4N/?click=5866959&flow=6636&land=lukoil_new
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
http://updt644-serv1ce.info/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer
http://updt644-serv1ce.info/

Response headers

date
Thu, 26 Aug 2021 16:24:02 GMT
content-type
text/plain; charset=utf-8
cache-control
no-cache, no-store, must-revalidate,post-check=0,pre-check=0
expires
0
last-modified
Thu, 26 Aug 2021 16:24:02 GMT
pragma
no-cache
set-cookie
_subid=1unr3k11n4p2;Expires=Sunday, 26-Sep-2021 16:24:02 GMT;Max-Age=2678400;Path=/ 0adc3=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjEwMFwiOjE2Mjk5OTUwNDIsXCIzMTBcIjoxNjI5OTk1MDQyfSxcImNhbXBhaWduc1wiOntcIjI4XCI6MTYyOTk5NTA0MixcIjU5XCI6MTYyOTk5NTA0Mn0sXCJ0aW1lXCI6MTYyOTk5NTA0Mn0ifQ.JN13cXxRAz7hTVVxgu8U6DltBCTVBV22dnW70-enQOk;Expires=Saturday, 22-Apr-2073 08:48:04 GMT;Max-Age=1630081442;Path=/
vary
Accept-Encoding
access-control-allow-origin
*
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fThNVgSsfyWeai%2BvZQ%2FhJnwZpKEaQCmN%2BRigc3YX%2B5Wj00Izp9kMfyjJtOwDT0nuHFPXJIYE6FfB5b%2F2ljEBLw4WkX%2FT%2Bk51TXJlgIj4O17Zbp%2FClNkCvfV7W2d2eKTcoI9KJO4ks5MP3Zda"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
684e68758dd54e50-FRA
content-encoding
br
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

Redirect headers

date
Thu, 26 Aug 2021 16:24:02 GMT
content-type
text/html; charset=utf-8
set-cookie
site22=6636; expires=Fri, 27-Aug-2021 16:24:02 GMT; Max-Age=86400; path=/
location
https://chk-3yfb1.xyz/HXFf4N/?click=5866959&flow=6636&land=lukoil_new
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eUFfrWmpZhWCd2T7wYJqsCZSOyVeiA93wU4WeSdJd3LNI2NnaTqmHnlRm96mdmJ9aZn6dRX7hgwNVy4Z%2FH4PmN2t%2BiOsdi0vgoWjOM0RVZhMNoWRbEsbkZSRZPL5uw%2BXnZUszdsMHzZdLXnio%2Bw%3D"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
684e68748c694e19-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated

2 Cookies

Domain/Path Name / Value
chk-3yfb1.xyz/ Name: 0adc3
Value: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjEwMFwiOjE2Mjk5OTUwNDIsXCIzMTBcIjoxNjI5OTk1MDQyfSxcImNhbXBhaWduc1wiOntcIjI4XCI6MTYyOTk5NTA0MixcIjU5XCI6MTYyOTk5NTA0Mn0sXCJ0aW1lXCI6MTYyOTk5NTA0Mn0ifQ.JN13cXxRAz7hTVVxgu8U6DltBCTVBV22dnW70-enQOk
chk-3yfb1.xyz/ Name: _subid
Value: 1unr3k11n4p2

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3grbbdf647g.xyz
chk-3yfb1.xyz
updt644-serv1ce.info
2606:4700:3030::6815:5c7c
2606:4700:3036::6815:626
87.251.86.26
32016daae0eaad16378cdc111722f7d2bbb302b2c4510b9ce6717038ed0350f1
e79d7a19af2677fcf765b4eacd3b75ef42ff0cb7a8a66397d793085f56921296