Submitted URL: https://t.co/n0Rp1ZErCg
Effective URL: https://klo.ua/wp-admin/ivwaj.php
Submission: On August 23 via api from US — Scanned from GB

Summary

This website contacted 6 IPs in 5 countries across 5 domains to perform 8 HTTP transactions. The main IP is 89.184.79.18, located in Kyiv, Ukraine and belongs to MIROHOST, US. The main domain is klo.ua.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on March 11th 2024. Valid for: a year.
This is the only time klo.ua was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 93.184.221.165 15133 (EDGECAST)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 6 89.184.79.18 25393 (MIROHOST)
1 104.17.24.14 13335 (CLOUDFLAR...)
1 13.74.129.92 8075 (MICROSOFT...)
8 6
Apex Domain
Subdomains
Transfer
6 klo.ua
klo.ua
www.klo.ua
32 KB
1 bing.com
r.g.bing.com — Cisco Umbrella Rank: 36311
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 336
14 KB
1 r2.dev
pub-a11d7bfe42a249639c96e3ee4ca70084.r2.dev
1 KB
1 t.co
t.co — Cisco Umbrella Rank: 979
582 B
8 5
Domain Requested by
4 klo.ua 1 redirects pub-a11d7bfe42a249639c96e3ee4ca70084.r2.dev
2 www.klo.ua 1 redirects
1 r.g.bing.com klo.ua
1 cdnjs.cloudflare.com klo.ua
1 pub-a11d7bfe42a249639c96e3ee4ca70084.r2.dev t.co
1 t.co
8 6

This site contains no links.

Subject Issuer Validity Valid
t.co
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2024-05-08 -
2025-05-07
a year crt.sh
*.r2.dev
E6
2024-08-01 -
2024-10-30
3 months crt.sh
klo.ua
Sectigo RSA Domain Validation Secure Server CA
2024-03-11 -
2025-04-01
a year crt.sh
cdnjs.cloudflare.com
WE1
2024-07-31 -
2024-10-29
3 months crt.sh
g.msn.com
Microsoft Azure RSA TLS Issuing CA 04
2024-04-11 -
2025-04-06
a year crt.sh

This page contains 1 frames:

Frame: https://r.g.bing.com/bam/ac?!&&u=a1aHR0cHM6Ly9uZXdtb29uLWNvbXBhbnkucnUvV3NxRW0vI1BFTUFJTEJBU0U2NA==
Frame ID: 50E567692EE27252072C4522E609890D
Requests: 10 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://t.co/n0Rp1ZErCg Page URL
  2. https://pub-a11d7bfe42a249639c96e3ee4ca70084.r2.dev/Sharepoint.html Page URL
  3. https://klo.ua/wp-admin/ivwaj.php Page URL
  4. https://klo.ua/wp-admin/ivwaj.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

8
Requests

88 %
HTTPS

20 %
IPv6

5
Domains

6
Subdomains

6
IPs

5
Countries

47 kB
Transfer

107 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://t.co/n0Rp1ZErCg Page URL
  2. https://pub-a11d7bfe42a249639c96e3ee4ca70084.r2.dev/Sharepoint.html Page URL
  3. https://klo.ua/wp-admin/ivwaj.php Page URL
  4. https://klo.ua/wp-admin/ivwaj.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 7
  • https://klo.ua/favicon.ico HTTP 301
  • https://www.klo.ua/favicon.ico HTTP 302
  • https://www.klo.ua/wp-content/uploads/2023/09/cropped-site-32x32.jpg

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
n0Rp1ZErCg
t.co/
356 B
582 B
Document
General
Full URL
https://t.co/n0Rp1ZErCg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
93.184.221.165 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software
tsa_f /
Resource Hash
0581fde0251ac0bef47e3f3de0893a90f310ed4abe8a9077cac64ae294ae3b2d
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

cache-control
private,max-age=300
content-encoding
gzip
content-length
212
content-type
text/html; charset=utf-8
date
Fri, 23 Aug 2024 00:41:17 GMT
expires
Fri, 23 Aug 2024 00:46:17 GMT
perf
7402827104
server
tsa_f
strict-transport-security
max-age=0
vary
Origin
x-connection-hash
111a42689c61d46123f4cfec2292f7ddcc7a4f897d916563e74296ff88b01a94
x-response-time
113
x-transaction-id
977cf3c5c0df5cab
x-xss-protection
0
Sharepoint.html
pub-a11d7bfe42a249639c96e3ee4ca70084.r2.dev/
962 B
1 KB
Document
General
Full URL
https://pub-a11d7bfe42a249639c96e3ee4ca70084.r2.dev/Sharepoint.html
Requested by
Host: t.co
URL: https://t.co/n0Rp1ZErCg
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b249983b690396a95e5c50f6bc9bf3ef25b21267db844f27d13768112eac1dd6

Request headers

Referer
https://t.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Accept-Ranges
bytes
CF-RAY
8b770e5d5d669445-LHR
Connection
keep-alive
Content-Length
962
Content-Type
text/html
Date
Fri, 23 Aug 2024 00:41:17 GMT
ETag
"457954f7000c8a4eb96158b6e27e9293"
Last-Modified
Thu, 22 Aug 2024 12:03:00 GMT
Server
cloudflare
Vary
Accept-Encoding
ivwaj.php
klo.ua/wp-admin/
40 KB
29 KB
Script
General
Full URL
https://klo.ua/wp-admin/ivwaj.php?6-797967704b53693230746650537933507a632f503030334f7a7931497a4b76554b79725644793875644d33564277413d-edibility
Requested by
Host: pub-a11d7bfe42a249639c96e3ee4ca70084.r2.dev
URL: https://pub-a11d7bfe42a249639c96e3ee4ca70084.r2.dev/Sharepoint.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.184.79.18 Kyiv, Ukraine, ASN25393 (MIROHOST, US),
Reverse DNS
es10.mirohost.net
Software
nginx /
Resource Hash
4fc55233de3a27a1c3ef21de869e2e8c08504185228d4accd59044fe4493901e
Security Headers
Name Value
Strict-Transport-Security max-age=300;

Request headers

Referer
https://pub-a11d7bfe42a249639c96e3ee4ca70084.r2.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Fri, 23 Aug 2024 00:41:17 GMT
content-encoding
gzip
referrer-policy
no-referrer-when-downgrade
strict-transport-security
max-age=300;
server
nginx
vary
X-Forwarded-Proto,Accept-Encoding
front-end-https
on
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
max-age=31536000
content-length
29220
expires
Sat, 23 Aug 2025 00:41:17 GMT
crypto-js.min.js
cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/
47 KB
14 KB
Script
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js
Requested by
Host: klo.ua
URL: https://klo.ua/wp-admin/ivwaj.php?6-797967704b53693230746650537933507a632f503030334f7a7931497a4b76554b79725644793875644d33564277413d-edibility
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eab5d90a71736f267af39fdf32caa8c71673fd06703279b01e0f92b0d7be0bfc
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
https://pub-a11d7bfe42a249639c96e3ee4ca70084.r2.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Fri, 23 Aug 2024 00:41:18 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
108695
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
14107
last-modified
Mon, 04 May 2020 16:09:17 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e2d-bb78"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=douzO2EIlQnM7LDCfBmsSkumRYzBJQSMMc1VRpLvMhDYS4eIKPT8FUG9d1O9BP2NClu03FxAbkGYbBD6SCItDOQdytdwFyBssO2dTzQDZBhP5RPTI1WNFFWSd22Oy3gf5ZovNlMM"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
8b770e5fbb0763fc-LHR
expires
Wed, 13 Aug 2025 00:41:18 GMT
truncated
/
1 KB
0
Stylesheet
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3f211ea21c6d42bad6c72f6092a807741c6f82b7c3c9aa99349f4c5288317ae9

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type
text/css
truncated
/
14 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
02a75ab1904e897ec34d78775a975e032f2b5ddd5e00352e9522440e56c292f9

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type
image/png
ivwaj.php
klo.ua/wp-admin/
2 KB
1 KB
Document
General
Full URL
https://klo.ua/wp-admin/ivwaj.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.184.79.18 Kyiv, Ukraine, ASN25393 (MIROHOST, US),
Reverse DNS
es10.mirohost.net
Software
nginx /
Resource Hash
1dba1f85846e7e3914743042b0c50c3641253e23c5b082762ae60a901d3072cc
Security Headers
Name Value
Strict-Transport-Security max-age=300;

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://pub-a11d7bfe42a249639c96e3ee4ca70084.r2.dev
Referer
https://pub-a11d7bfe42a249639c96e3ee4ca70084.r2.dev/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

access-control-allow-origin
*
content-encoding
gzip
content-length
868
content-type
text/html; charset=UTF-8
date
Fri, 23 Aug 2024 00:41:19 GMT
front-end-https
on
referrer-policy
no-referrer-when-downgrade
server
nginx
strict-transport-security
max-age=300;
vary
X-Forwarded-Proto,Accept-Encoding
cropped-site-32x32.jpg
www.klo.ua/wp-content/uploads/2023/09/
Redirect Chain
  • https://klo.ua/favicon.ico
  • https://www.klo.ua/favicon.ico
  • https://www.klo.ua/wp-content/uploads/2023/09/cropped-site-32x32.jpg
778 B
994 B
Other
General
Full URL
https://www.klo.ua/wp-content/uploads/2023/09/cropped-site-32x32.jpg
Protocol
H2
Server
89.184.79.18 Kyiv, Ukraine, ASN25393 (MIROHOST, US),
Reverse DNS
es10.mirohost.net
Software
nginx /
Resource Hash
473ea10de04e6b45875033b0a19724d2fccb0b2172a718f25d788cd6f52ace5f

Request headers

Referer
https://klo.ua/wp-admin/ivwaj.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Fri, 23 Aug 2024 00:41:20 GMT
last-modified
Fri, 09 Feb 2024 15:30:54 GMT
server
nginx
etag
"65c6452e-30a"
content-type
image/jpeg
cache-control
max-age=7776000, public, must-revalidate, proxy-revalidate
accept-ranges
bytes
content-length
778
expires
Thu, 21 Nov 2024 00:41:20 GMT

Redirect headers

date
Fri, 23 Aug 2024 00:41:20 GMT
strict-transport-security
max-age=300;
referrer-policy
no-referrer-when-downgrade
server
nginx
x-redirect-by
WordPress
vary
X-Forwarded-Proto,Accept-Encoding
front-end-https
on
content-type
text/html; charset=UTF-8
location
https://www.klo.ua/wp-content/uploads/2023/09/cropped-site-32x32.jpg
link
<https://www.klo.ua/wp-json/>; rel="https://api.w.org/"
content-length
0
Primary Request ivwaj.php
klo.ua/wp-admin/
146 B
382 B
Document
General
Full URL
https://klo.ua/wp-admin/ivwaj.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.184.79.18 Kyiv, Ukraine, ASN25393 (MIROHOST, US),
Reverse DNS
es10.mirohost.net
Software
nginx /
Resource Hash
85b8412c9037e4113ec159fdb20c54b8647e08dbc11e8befa7aa1e65039ccdba
Security Headers
Name Value
Strict-Transport-Security max-age=300;

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://klo.ua
Referer
https://klo.ua/wp-admin/ivwaj.php
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

access-control-allow-origin
*
content-encoding
gzip
content-length
158
content-type
text/html; charset=UTF-8
date
Fri, 23 Aug 2024 00:41:20 GMT
front-end-https
on
referrer-policy
no-referrer-when-downgrade
server
nginx
strict-transport-security
max-age=300;
vary
X-Forwarded-Proto,Accept-Encoding
ac
r.g.bing.com/bam/
0
0
Document
General
Full URL
https://r.g.bing.com/bam/ac?!&&u=a1aHR0cHM6Ly9uZXdtb29uLWNvbXBhbnkucnUvV3NxRW0vI1BFTUFJTEJBU0U2NA==
Requested by
Host: klo.ua
URL: https://klo.ua/wp-admin/ivwaj.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.74.129.92 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://klo.ua/wp-admin/ivwaj.php
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

access-control-allow-origin
*
cache-control
no-cache, must-revalidate
date
Fri, 23 Aug 2024 00:41:21 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
pragma
no-cache
server
Microsoft-IIS/10.0
strict-transport-security
max-age=31536000; includeSubDomains; preload

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Domain/Path Name / Value
.t.co/ Name: muc
Value: 448a1be1-ea53-4445-b344-a1ed6a32f07b
.bing.com/ Name: MUID
Value: 3552CB63016D645C175BDF87056D6751

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=0
X-Xss-Protection 0