Submitted URL: https://www.gaz-mobilite.fr/widget/redirect-lead.php?id_vh=134&url=http%3A%2F%2F5rbj0r43.dwcae.ru/ixrg2oct43wwwgaz-mobilitefrs4
Effective URL: http://5rbj0r43.dwcae.ru/ixrg2oct43wwwgaz-mobilitefrs4&campaignid=&model_id=&kind=
Submission: On October 16 via api from DE — Scanned from DE

Summary

This website contacted 5 IPs in 3 countries across 4 domains to perform 6 HTTP transactions. The main IP is 2606:4700:3033::ac43:b087, located in United States and belongs to CLOUDFLARENET, US. The main domain is 5rbj0r43.dwcae.ru.
This is the only time 5rbj0r43.dwcae.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 85.236.156.250 53589 (PLANETHOS...)
2 2606:4700:e0:... 13335 (CLOUDFLAR...)
2 2606:4700:303... 13335 (CLOUDFLAR...)
1 2 88.212.201.204 39134 (UNITEDNET)
6 5
Apex Domain
Subdomains
Transfer
2 yadro.ru
counter.yadro.ru — Cisco Umbrella Rank: 10154
1 KB
2 dwcae.ru
5rbj0r43.dwcae.ru
5 KB
2 fontawesome.com
use.fontawesome.com — Cisco Umbrella Rank: 1214
85 KB
1 gaz-mobilite.fr
www.gaz-mobilite.fr
750 B
6 4
Domain Requested by
2 counter.yadro.ru 1 redirects 5rbj0r43.dwcae.ru
2 5rbj0r43.dwcae.ru 5rbj0r43.dwcae.ru
2 use.fontawesome.com www.gaz-mobilite.fr
use.fontawesome.com
1 www.gaz-mobilite.fr
6 4

This site contains links to these domains. Also see Links.

Domain
xaxaxa.antibot.cloud
www.liveinternet.ru
Subject Issuer Validity Valid
*.vehicule-ecologique.net
R3
2023-10-07 -
2024-01-05
3 months crt.sh
use.fontawesome.com
Cloudflare Inc ECC CA-3
2023-10-12 -
2024-10-10
a year crt.sh

This page contains 1 frames:

Primary Page: http://5rbj0r43.dwcae.ru/ixrg2oct43wwwgaz-mobilitefrs4&campaignid=&model_id=&kind=
Frame ID: F684A086AB0471ABF485A3ADE0D0ADB5
Requests: 7 HTTP requests in this frame

Screenshot

Page Title

Warten.

Page URL History Show full URLs

  1. https://www.gaz-mobilite.fr/widget/redirect-lead.php?id_vh=134&url=http%3A%2F%2F5rbj0r43.dwcae.ru/ixrg2o... Page URL
  2. http://5rbj0r43.dwcae.ru/ixrg2oct43wwwgaz-mobilitefrs4&campaignid=&model_id=&kind= Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Overall confidence: 100%
Detected patterns
  • <!--LiveInternet counter-->
  • <!--/LiveInternet-->

Page Statistics

6
Requests

50 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

5
IPs

3
Countries

92 kB
Transfer

134 kB
Size

6
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.gaz-mobilite.fr/widget/redirect-lead.php?id_vh=134&url=http%3A%2F%2F5rbj0r43.dwcae.ru/ixrg2oct43wwwgaz-mobilitefrs4 Page URL
  2. http://5rbj0r43.dwcae.ru/ixrg2oct43wwwgaz-mobilitefrs4&campaignid=&model_id=&kind= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4
  • https://counter.yadro.ru/hit;essa?t52.6;r;s1600*1200*24;uhttp%3A//5rbj0r43.dwcae.ru/ixrg2oct43wwwgaz-mobilitefrs4%26campaignid%3D%26model_id%3D%26kind%3D;hWarten.;0.9902692181268336 HTTP 302
  • https://counter.yadro.ru/hit;essa?q;t52.6;r;s1600*1200*24;uhttp%3A//5rbj0r43.dwcae.ru/ixrg2oct43wwwgaz-mobilitefrs4%26campaignid%3D%26model_id%3D%26kind%3D;hWarten.;0.9902692181268336

6 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
redirect-lead.php
www.gaz-mobilite.fr/widget/
896 B
750 B
Document
General
Full URL
https://www.gaz-mobilite.fr/widget/redirect-lead.php?id_vh=134&url=http%3A%2F%2F5rbj0r43.dwcae.ru/ixrg2oct43wwwgaz-mobilitefrs4
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
85.236.156.250 Paris, France, ASN53589 (PLANETHOSTER-8, CA),
Reverse DNS
lyman.fr.planethoster.net
Software
LiteSpeed /
Resource Hash
742118219f053c3121a046716068a6acf73e16e5e50df3120d6ba9b37c19ec88

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language
de-DE,de;q=0.9
referer
https://www.google.com/search?q=kaufen

Response headers

alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding
br
content-length
474
content-type
text/html; charset=UTF-8
date
Mon, 16 Oct 2023 12:23:53 GMT
expires
Mon, 16 Oct 2023 14:23:53 GMT
server
LiteSpeed
vary
Accept-Encoding,User-Agent
all.css
use.fontawesome.com/releases/v5.8.1/css/
54 KB
12 KB
Stylesheet
General
Full URL
https://use.fontawesome.com/releases/v5.8.1/css/all.css
Requested by
Host: www.gaz-mobilite.fr
URL: https://www.gaz-mobilite.fr/widget/redirect-lead.php?id_vh=134&url=http%3A%2F%2F5rbj0r43.dwcae.ru/ixrg2oct43wwwgaz-mobilitefrs4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e0::ac40:660b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eeb17a45a48aca1d7adbcf04de155dcd0b47cb36ad036310446bb471fea9aaa3

Request headers

Referer
https://www.google.com/search?q=kaufen
Origin
https://www.gaz-mobilite.fr
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date
Mon, 16 Oct 2023 12:23:54 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 22 Sep 2023 01:45:55 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
8993
etag
W/"e4c542a7f6bf6f74fdd8cdf6e8096396"
vary
Origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FnaaDg7rLP5fzpM9Lmzr7RrDcL5%2BRIcWrpXGW4%2BZsB9nGsB%2BdwFAUwOMExeIs6l7IC%2FFUEGJRc7ZFn07vwcLWoutwhQCdV4%2FAPzc3JjAKR2QXsbkTi%2B2DFf5WyP8D5kCvQUw59gCLE1Lp3cZEfzyNHDO"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31556926
cf-ray
81704696bd489030-FRA
alt-svc
h3=":443"; ma=86400
fa-solid-900.woff2
use.fontawesome.com/releases/v5.8.1/webfonts/
73 KB
73 KB
Font
General
Full URL
https://use.fontawesome.com/releases/v5.8.1/webfonts/fa-solid-900.woff2
Requested by
Host: use.fontawesome.com
URL: https://use.fontawesome.com/releases/v5.8.1/css/all.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e0::ac40:660b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f18c486a80175cf02fee0e05c2b4acd86c04cdbaecec61c1ef91f920509b5efe

Request headers

Referer
https://www.google.com/search?q=kaufen
Origin
https://www.gaz-mobilite.fr
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date
Mon, 16 Oct 2023 12:23:54 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
8992
alt-svc
h3=":443"; ma=86400
content-length
74256
last-modified
Fri, 22 Sep 2023 01:45:57 GMT
server
cloudflare
etag
"418dad87601f9c8abd0e5798c0dc1feb"
vary
Origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CTYHn8qWkJLQ2JQyTFpk5Fa%2Bo%2FIEIutxHLYge334fJ2e8EF8zuGpat084OYRogj54VNIo02bm4xkMNw6eImtdfLvk2ORd6BitK5ak1GOcBt0ThnNM%2Ba4z5eM2ecZLgD0Y%2Bjb7brT8MEZ15okD5hNQg4T"}],"group":"cf-nel","max_age":604800}
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31556926
accept-ranges
bytes
cf-ray
81704696dd669030-FRA
Primary Request ixrg2oct43wwwgaz-mobilitefrs4&campaignid=&model_id=&kind=
5rbj0r43.dwcae.ru/
6 KB
4 KB
Document
General
Full URL
http://5rbj0r43.dwcae.ru/ixrg2oct43wwwgaz-mobilitefrs4&campaignid=&model_id=&kind=
Protocol
HTTP/1.1
Server
2606:4700:3033::ac43:b087 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b11dc6ca620873c9172dc5a0ea60ceac52907d910aa734a2988936362ced5071

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language
de-DE,de;q=0.9
referer
https://www.google.com/search?q=kaufen

Response headers

CF-Cache-Status
DYNAMIC
CF-RAY
8170469d4f1d9b95-FRA
Cache-Control
no-store, no-cache, must-revalidate
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Mon, 16 Oct 2023 12:23:55 GMT
Expires
Mon, 26 Jul 1997 05:00:00 GMT
Link
</antibot/ab.php>; rel=dns-prefetch
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=r7IGFc8FF8zHbpp8Vj29z62SWQWCnmzX7AUIANkSLnr6uk50kdnA6dMd32rXsDM8hIu%2FyWQlitXt0lPXFcqjbcuZh8P%2BLbaxomSV%2F7rKsxCP7xF8Zu5Xj5OxLgTHOkNMTTfZkQIPC40nJ%2FiUb9TILg%3D%3D"}],"group":"cf-nel","max_age":604800}
Server
cloudflare
Transfer-Encoding
chunked
X-Robots-Tag
noindex
alt-svc
h3=":443"; ma=86400
truncated
/
42 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/search?q=kaufen
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type
image/gif
hit;essa
counter.yadro.ru/
Redirect Chain
  • https://counter.yadro.ru/hit;essa?t52.6;r;s1600*1200*24;uhttp%3A//5rbj0r43.dwcae.ru/ixrg2oct43wwwgaz-mobilitefrs4%26campaignid%3D%26model_id%3D%26kind%3D;hWarten.;0.9902692181268336
  • https://counter.yadro.ru/hit;essa?q;t52.6;r;s1600*1200*24;uhttp%3A//5rbj0r43.dwcae.ru/ixrg2oct43wwwgaz-mobilitefrs4%26campaignid%3D%26model_id%3D%26kind%3D;hWarten.;0.9902692181268336
362 B
848 B
Image
General
Full URL
https://counter.yadro.ru/hit;essa?q;t52.6;r;s1600*1200*24;uhttp%3A//5rbj0r43.dwcae.ru/ixrg2oct43wwwgaz-mobilitefrs4%26campaignid%3D%26model_id%3D%26kind%3D;hWarten.;0.9902692181268336
Requested by
Host: 5rbj0r43.dwcae.ru
URL: http://5rbj0r43.dwcae.ru/ixrg2oct43wwwgaz-mobilitefrs4&campaignid=&model_id=&kind=
Protocol
HTTP/1.1
Server
88.212.201.204 , Russian Federation, ASN39134 (UNITEDNET, RU),
Reverse DNS
host204.rax.ru
Software
nginx/1.17.9 /
Resource Hash
a73d6739819ba98621e4bdb24bc2fbc2c88583479558b9878e5b986d3b59341d
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/search?q=kaufen
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 16 Oct 2023 12:23:56 GMT
Strict-Transport-Security
max-age=86400
Server
nginx/1.17.9
Content-Type
image/gif
P3P
policyref="/w3c/p3p.xml", CP="UNI"
Access-Control-Allow-Origin
*
Cache-control
no-cache
Connection
keep-alive
Content-Length
362
Expires
Sat, 15 Oct 2022 21:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Mon, 16 Oct 2023 12:23:56 GMT
Strict-Transport-Security
max-age=86400
Server
nginx/1.17.9
Content-Type
text/html
Location
https://counter.yadro.ru/hit;essa?q;t52.6;r;s1600*1200*24;uhttp%3A//5rbj0r43.dwcae.ru/ixrg2oct43wwwgaz-mobilitefrs4%26campaignid%3D%26model_id%3D%26kind%3D;hWarten.;0.9902692181268336
P3P
policyref="/w3c/p3p.xml", CP="UNI"
Cache-control
no-cache
Connection
keep-alive
Content-Length
32
Expires
Sat, 15 Oct 2022 21:00:00 GMT
ab.php
5rbj0r43.dwcae.ru/antibot/
20 B
962 B
XHR
General
Full URL
http://5rbj0r43.dwcae.ru/antibot/ab.php
Requested by
Host: 5rbj0r43.dwcae.ru
URL: http://5rbj0r43.dwcae.ru/ixrg2oct43wwwgaz-mobilitefrs4&campaignid=&model_id=&kind=
Protocol
HTTP/1.1
Server
2606:4700:3033::ac43:b087 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4126152e5de56c91a80501fff22a1695aeff15514a3eee588861cd50d5582f3b

Request headers

Referer
https://www.google.com/search?q=kaufen
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-type
application/x-www-form-urlencoded;

Response headers

Date
Mon, 16 Oct 2023 12:23:56 GMT
Content-Encoding
gzip
CF-Cache-Status
DYNAMIC
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Transfer-Encoding
chunked
X-Powered-CMS
AntiBot.Cloud (See: https://antibot.cloud/)
Connection
keep-alive
alt-svc
h3=":443"; ma=86400
Server
cloudflare
Access-Control-Allow-Methods
POST
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4%2BhYoZOstSHdKVxkwnNoPKFJY2TMTbW%2BQ%2FByK0L5O%2FMaNhhPkgwvF16K2Stv7jO91HW%2FO26l3K0KLPGr2ziX1%2B3oDGdZsT4ex2OyVqXKu4yt91dhXUTcMUGaGyVrXXIud0Bncrz0PUqWHuG9Uw28cQ%3D%3D"}],"group":"cf-nel","max_age":604800}
Access-Control-Allow-Origin
*
Content-Type
text/html; charset=UTF-8
Cache-Control
no-store, no-cache, must-revalidate
X-Robots-Tag
noindex
Access-Control-Allow-Headers
*
CF-RAY
817046a499ec9b95-FRA
Expires
Mon, 26 Jul 1997 05:00:00 GMT

Verdicts & Comments Add Verdict or Comment

26 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| b64_to_utf8 string| country string| action string| h1 string| h2 string| ipfull string| ip string| via string| v string| re string| rk string| ho string| cid string| ptr number| width number| height number| cwidth number| cheight number| colordepth number| pixeldepth string| phpreferrer string| referrer function| nore function| Button function| CloudTest function| HideBtnClick

6 Cookies

Domain/Path Name / Value
5rbj0r43.dwcae.ru/ Name: antibot_uid
Value: 817cc54d11172c02d7beccf75a4e485c
5rbj0r43.dwcae.ru/ Name: antibot_country
Value: DE
5rbj0r43.dwcae.ru/ Name: antibot_lang
Value: de
5rbj0r43.dwcae.ru/ Name: antibot_ptr
Value: unn-fra.cdn77.com
.yadro.ru/ Name: FTID
Value: 1bBIjS2Zp1Of1bBIjS002PXH
.yadro.ru/ Name: VID
Value: 0W5eZz3geQOf1bBIjS002FLk