play.stormstone.top Open in urlscan Pro
116.202.184.109 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://kluser-hehli.ch/
Effective URL:
https://play.stormstone.top/eyes-robot/?pl=wyqwIiui3U-oMKNOfTV6Dg&sm=eyes-robot&hash=3XDrwOBqZUP_OjQmmwn2Bg&exp=1677526545
Submission: On February 27 via automatic, source certstream-suspicious (February 27th 2023, 7:30:45 pm UTC) — Scanned from NL

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 5 domains to perform 10 HTTP transactions. The main IP is 116.202.184.109, located in and belongs to . The main domain is play.stormstone.top.
TLS certificate: Issued by R3 on January 6th 2023. Valid for: 3 months.

This is the only time play.stormstone.top was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 3	2a06:98c1:312... 2a06:98c1:3120::c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	88.212.201.198 88.212.201.198	39134 (UNITEDNET) (UNITEDNET)
1 1	185.155.184.84 185.155.184.84	() ()
1	116.202.184.109 116.202.184.109	() ()
10	4

3 2a06:98c1:3120::c (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

kluser-hehli.ch	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 88.212.201.198 (Russian Federation) 1 redirects

ASN39134 (UNITEDNET, RU)
PTR: host198.rax.ru

counter.yadro.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.155.184.84 (None, ) 1 redirects

ASN- ()

mvgde.fastssp.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 116.202.184.109 (None, )

ASN- ()

play.stormstone.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	kluser-hehli.ch 1 redirects kluser-hehli.ch	5 KB
2	yadro.ru 1 redirects counter.yadro.ru — Cisco Umbrella Rank: 9857	1 KB
1	stormstone.top play.stormstone.top
1	fastssp.top 1 redirects mvgde.fastssp.top	378 B
0	pushssp.top Failed js.pushssp.top Failed
10	5

	Domain	Requested by
3	kluser-hehli.ch	1 redirects kluser-hehli.ch
2	counter.yadro.ru	1 redirects kluser-hehli.ch
1	play.stormstone.top	kluser-hehli.ch play.stormstone.top
1	mvgde.fastssp.top	1 redirects
0	js.pushssp.top Failed	play.stormstone.top
10	5

This site contains no links.

Subject Issuer	Validity	Valid
*.kluser-hehli.ch GTS CA 1P5	`2023-02-27` - `2023-05-28`	3 months	crt.sh
stormstone.top R3	`2023-01-06` - `2023-04-06`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://play.stormstone.top/eyes-robot/?pl=wyqwIiui3U-oMKNOfTV6Dg&sm=eyes-robot&hash=3XDrwOBqZUP_OjQmmwn2Bg&exp=1677526545
Frame ID: 86CF994F1FBB0E6DE834475D9C4B7CBB
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://kluser-hehli.ch/ Page URL
https://kluser-hehli.ch/ HTTP 301
https://mvgde.fastssp.top/?pl=wyqwIiui3U-oMKNOfTV6Dg HTTP 302
https://play.stormstone.top/eyes-robot/?pl=wyqwIiui3U-oMKNOfTV6Dg&sm=eyes-robot&hash=3XDrwOBqZUP_OjQmmwn... Page URL

Page Statistics

10
Requests

30 %
HTTPS

25 %
IPv6

5
Domains

5
Subdomains

4
IPs

2
Countries

4 kB
Transfer

7 kB
Size

8
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://kluser-hehli.ch/ Page URL
https://kluser-hehli.ch/ HTTP 301
https://mvgde.fastssp.top/?pl=wyqwIiui3U-oMKNOfTV6Dg HTTP 302
https://play.stormstone.top/eyes-robot/?pl=wyqwIiui3U-oMKNOfTV6Dg&sm=eyes-robot&hash=3XDrwOBqZUP_OjQmmwn2Bg&exp=1677526545 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

https://counter.yadro.ru/hit;lootraff?r;s1600*1200*24;uhttps%3A//kluser-hehli.ch/;hWacht.;0.67117474582517 HTTP 302
https://counter.yadro.ru/hit;lootraff?q;r;s1600*1200*24;uhttps%3A//kluser-hehli.ch/;hWacht.;0.67117474582517

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 / Show response
kluser-hehli.ch/ 6 KB
3 KB 17691ms
17617ms Document
text/html 2a06:98c1:3120::c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://kluser-hehli.ch/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 77a0754a9517b6b81b3a4f3f0332e433b036bd59d8498756891c05d9a8aa0429

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 7a03559bf9dcbb77-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Mon, 27 Feb 2023 19:30:37 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: </antibot777--/ab.php>; rel=dns-prefetch
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3CtMM%2FC2X5TVuZKUBl0k2LfIZSZt6LSt7xu5EQ150y4Oxpvsjb%2FZPUjQpPVi09Yu4aS5zJ4%2FlQInodifNNQvGyRwie9OTBVqlokhuvOKrX%2B0xQ4Y0AB4vEGFY8mDIxKrJ2Mq5r7S6PJaUAQ4By8%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-robots-tag: noindex

GET
H/1.1

200
OK

hit;lootraff
counter.yadro.ru/
Redirect Chain

https://counter.yadro.ru/hit;lootraff?r;s1600*1200*24;uhttps%3A//kluser-hehli.ch/;hWacht.;0.67117474582517
https://counter.yadro.ru/hit;lootraff?q;r;s1600*1200*24;uhttps%3A//kluser-hehli.ch/;hWacht.;0.67117474582517

43 B
528 B

52ms
52ms

Image
image/gif

88.212.201.198
UNITEDNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://counter.yadro.ru/hit;lootraff?q;r;s1600*1200*24;uhttps%3A//kluser-hehli.ch/;hWacht.;0.67117474582517

Requested by

Host: kluser-hehli.ch
URL: https://kluser-hehli.ch/

Protocol

HTTP/1.1

Server

88.212.201.198 , Russian Federation, ASN39134 (UNITEDNET, RU),

Reverse DNS

host198.rax.ru

Software

nginx/1.17.9 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kluser-hehli.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 27 Feb 2023 19:30:38 GMT
Strict-Transport-Security: max-age=86400
Server: nginx/1.17.9
Content-Type: image/gif
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Access-Control-Allow-Origin: *
Cache-control: no-cache
Connection: keep-alive
Content-Length: 43
Expires: Sat, 26 Feb 2022 21:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 27 Feb 2023 19:30:37 GMT
Strict-Transport-Security: max-age=86400
Server: nginx/1.17.9
Content-Type: text/html
Location: https://counter.yadro.ru/hit;lootraff?q;r;s1600*1200*24;uhttps%3A//kluser-hehli.ch/;hWacht.;0.67117474582517
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Cache-control: no-cache
Connection: keep-alive
Content-Length: 32
Expires: Sat, 26 Feb 2022 21:00:00 GMT

POST
H2 200 ab.php
kluser-hehli.ch/antibot777--/ 71 B
473 B 224ms
223ms XHR
text/html 2a06:98c1:3120::c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://kluser-hehli.ch/antibot777--/ab.php
Requested by: Host: kluser-hehli.ch
URL: https://kluser-hehli.ch/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://kluser-hehli.ch/
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-type: application/x-www-form-urlencoded;

Response headers

date: Mon, 27 Feb 2023 19:30:38 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-cms: AntiBot.Cloud (See: https://antibot.cloud/)
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: POST
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9pl4b9rX5LizXLwWGRpYsJbzm6xPWW1TwsM4%2FaTDZ6SOlGaonjpZSmw3RO0cii%2Br5RROPKWiEjBXI3wFKLf4zyUKj31bRgDPSh%2BGMB9HmaGApKYz%2Fz4haAf95LCKi8zpORNZS175G9uBOeBO8jc%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
content-type: text/html; charset=UTF-8
cache-control: no-store, no-cache, must-revalidate
x-robots-tag: noindex
access-control-allow-headers: *
cf-ray: 7a03560a4c02bb77-FRA
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

Primary Request /
play.stormstone.top/eyes-robot/
Redirect Chain

https://kluser-hehli.ch/
https://mvgde.fastssp.top/?pl=wyqwIiui3U-oMKNOfTV6Dg
https://play.stormstone.top/eyes-robot/?pl=wyqwIiui3U-oMKNOfTV6Dg&sm=eyes-robot&hash=3XDrwOBqZUP_OjQmmwn2Bg&exp=1677526545

1 KB
0

108ms
23ms

Document
text/html

116.202.184.109

General

Check archive.org

Show headers Download Go to

Full URL

https://play.stormstone.top/eyes-robot/?pl=wyqwIiui3U-oMKNOfTV6Dg&sm=eyes-robot&hash=3XDrwOBqZUP_OjQmmwn2Bg&exp=1677526545

Requested by

Host: kluser-hehli.ch
URL: https://kluser-hehli.ch/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

116.202.184.109 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Referer: https://kluser-hehli.ch/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

content-encoding: gzip
content-type: text/html
date: Mon, 27 Feb 2023 19:30:45 GMT
etag: W/"63a427eb-535"
last-modified: Thu, 22 Dec 2022 09:48:27 GMT
server: nginx
strict-transport-security: max-age=63072000
vary: Accept-Encoding

Redirect headers

cache-control: max-age=0, no-cache, no-store, must-revalidate
content-length: 0
date: Mon, 27 Feb 2023 19:30:45 GMT
location: https://play.stormstone.top/eyes-robot/?pl=wyqwIiui3U-oMKNOfTV6Dg&sm=eyes-robot&hash=3XDrwOBqZUP_OjQmmwn2Bg&exp=1677526545
server: nginx

GET trls.js
play.stormstone.top/eyes-robot/assets/ 0
0

GET fnr.js
play.stormstone.top/shared-js/assets/ 0
0

GET style.css
play.stormstone.top/eyes-robot/assets/ 0
0

GET 1.png
play.stormstone.top/eyes-robot/assets/ 0
0

GET 2.png
play.stormstone.top/eyes-robot/assets/ 0
0

GET pl.js
js.pushssp.top/ps/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: play.stormstone.top
URL: https://play.stormstone.top/eyes-robot/assets/trls.js

Domain: play.stormstone.top
URL: https://play.stormstone.top/shared-js/assets/fnr.js

Domain: play.stormstone.top
URL: https://play.stormstone.top/eyes-robot/assets/style.css

Domain: play.stormstone.top
URL: https://play.stormstone.top/eyes-robot/assets/1.png

Domain: play.stormstone.top
URL: https://play.stormstone.top/eyes-robot/assets/2.png

Domain: js.pushssp.top
URL: https://js.pushssp.top/ps/pl.js

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless

8 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
kluser-hehli.ch/	1970-01-20 18:44:22	Name: antibot_uid Value: 37345ea5cf7e932932cfbb441e5806a9
kluser-hehli.ch/	1970-01-20 10:13:10	Name: antibot_country Value: NL
kluser-hehli.ch/	1970-01-20 10:13:10	Name: antibot_lang Value: nl
kluser-hehli.ch/	1970-01-20 10:13:10	Name: antibot_ptr Value: 2001%3A1af8%3A4700%3Aa08a%3A0004%3A0000%3A0000%3A0006
.yadro.ru/	1970-01-20 18:43:01	Name: FTID Value: 1Z_GJT2YLHOV1Z_GJT001IjR
kluser-hehli.ch/	1970-01-20 10:13:10	Name: antibot_2cd073b8f9a985cdff1caf834dced33f Value: 33c4dfd2f0f2cc86c0448c288b98bf5f
kluser-hehli.ch/	1970-01-20 10:13:10	Name: lastcid Value: 1677526236.502
.yadro.ru/	1970-01-20 18:43:01	Name: VID Value: 1Zl5tI2vzQuV1Z_GJU001EEN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

counter.yadro.ru
js.pushssp.top
kluser-hehli.ch
mvgde.fastssp.top
play.stormstone.top
js.pushssp.top
play.stormstone.top
116.202.184.109
185.155.184.84
2a06:98c1:3120::c
88.212.201.198
77a0754a9517b6b81b3a4f3f0332e433b036bd59d8498756891c05d9a8aa0429

play.stormstone.top Open in urlscan Pro 116.202.184.109 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

10 Requests

30 %HTTPS

25 %IPv6

5 Domains

5 Subdomains

4 IPs

2 Countries

4 kBTransfer

7 kBSize

8 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Failed requests

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

8 Cookies

Indicators

play.stormstone.top Open in urlscan Pro
116.202.184.109 Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

30 %
HTTPS

25 %
IPv6

5
Domains

5
Subdomains

4
IPs

2
Countries

4 kB
Transfer

7 kB
Size

8
Cookies

10 HTTP transactions
0 data transactions