srv201002.hoster-test.ru Open in urlscan Pro
31.28.24.131 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://sendpost-37589.sptrackh.com/api/v1/track/click/7/37589/263/default/35564288-65dc-4e2e-b708-7dcd2e0850df?redirecturl=https://...
Effective URL:
http://srv201002.hoster-test.ru/CHFINAL
Submission: On October 10 via manual (October 10th 2023, 8:42:59 am UTC) from CH — Scanned from CH

Summary HTTP 2 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 4 countries across 4 domains to perform 2 HTTP transactions. The main IP is 31.28.24.131, located in St Petersburg, Russian Federation and belongs to HOSTING-MSK, RU. The main domain is srv201002.hoster-test.ru.

This is the only time srv201002.hoster-test.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	54.92.251.90 54.92.251.90	14618 (AMAZON-AES) (AMAZON-AES)
1 1	51.254.94.36 51.254.94.36	16276 (OVH) (OVH)
1 1	51.254.94.37 51.254.94.37	16276 (OVH) (OVH)
1	43.231.124.117 43.231.124.117	56110 (EVERDATA-...) (EVERDATA-DATACENTERS Everdata Technologies Pvt Ltd)
1	31.28.24.131 31.28.24.131	12616 (HOSTING-MSK) (HOSTING-MSK)
2	2

1 54.92.251.90 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-92-251-90.compute-1.amazonaws.com

sendpost-37589.sptrackh.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 51.254.94.36 (France) 1 redirects

ASN16276 (OVH, FR)
PTR: ip36.ip-51-254-94.eu

l-k.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 51.254.94.37 (France) 1 redirects

ASN16276 (OVH, FR)
PTR: ip37.ip-51-254-94.eu

s.l-k.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 43.231.124.117 (India)

ASN56110 (EVERDATA-DATACENTERS Everdata Technologies Pvt Ltd, IN)
PTR: 43.231.124.117.everdata.network

nakasacropscience.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 31.28.24.131 (St Petersburg, Russian Federation)

ASN12616 (HOSTING-MSK, RU)
PTR: c06w.hoster.ru

srv201002.hoster-test.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	l-k.io 2 redirects l-k.io s.l-k.io	436 B
1	hoster-test.ru srv201002.hoster-test.ru	562 B
1	nakasacropscience.com nakasacropscience.com	328 B
1	sptrackh.com 1 redirects sendpost-37589.sptrackh.com	352 B
2	4

	Domain	Requested by
1	srv201002.hoster-test.ru
1	nakasacropscience.com
1	s.l-k.io	1 redirects
1	l-k.io	1 redirects
1	sendpost-37589.sptrackh.com	1 redirects
2	5

This site contains no links.

Subject Issuer	Validity	Valid
nakasacropscience.com R3	`2023-10-06` - `2024-01-04`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://srv201002.hoster-test.ru/CHFINAL
Frame ID: F80A3AA5FD440BAD87ACA01D07DAE77B
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

403 Forbidden

Page URL History Show full URLs

https://sendpost-37589.sptrackh.com/api/v1/track/click/7/37589/263/default/35564288-65dc-4e2e-b708-7dcd2e0850df?... HTTP 302
https://l-k.io/3FX9hU HTTP 301
http://s.l-k.io/lum/api/shortener/3FX9hU HTTP 307
https://s.l-k.io/lum/api/shortener/3FX9hU HTTP 302
https://nakasacropscience.com/css/1.php Page URL
http://srv201002.hoster-test.ru/CHFINAL Page URL

Page Statistics

2
Requests

50 %
HTTPS

0 %
IPv6

4
Domains

5
Subdomains

2
IPs

4
Countries

1 kB
Transfer

0 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://sendpost-37589.sptrackh.com/api/v1/track/click/7/37589/263/default/35564288-65dc-4e2e-b708-7dcd2e0850df?redirecturl=https://l-k.io/3FX9hU HTTP 302
https://l-k.io/3FX9hU HTTP 301
http://s.l-k.io/lum/api/shortener/3FX9hU HTTP 307
https://s.l-k.io/lum/api/shortener/3FX9hU HTTP 302
https://nakasacropscience.com/css/1.php Page URL
http://srv201002.hoster-test.ru/CHFINAL Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://sendpost-37589.sptrackh.com/api/v1/track/click/7/37589/263/default/35564288-65dc-4e2e-b708-7dcd2e0850df?redirecturl=https://l-k.io/3FX9hU HTTP 302
https://l-k.io/3FX9hU HTTP 301
http://s.l-k.io/lum/api/shortener/3FX9hU HTTP 307
https://s.l-k.io/lum/api/shortener/3FX9hU HTTP 302
https://nakasacropscience.com/css/1.php

2 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	1.php Show response nakasacropscience.com/css/ Redirect Chain https://sendpost-37589.sptrackh.com/api/v1/track/click/7/37589/263/default/35564288-65dc-4e2e-b708-7dcd2e0850df?redirecturl=https://l-k.io/3FX9hU https://l-k.io/3FX9hU http://s.l-k.io/lum/api/shortener/3FX9hU https://s.l-k.io/lum/api/shortener/3FX9hU https://nakasacropscience.com/css/1.php	88 B 328 B	1032ms 211ms	Document text/html	43.231.124.117 EVERDATA-DATACENT...
General Check archive.org Show headers Download Go to Full URL https://nakasacropscience.com/css/1.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 43.231.124.117 , India, ASN56110 (EVERDATA-DATACENTERS Everdata Technologies Pvt Ltd, IN), Reverse DNS 43.231.124.117.everdata.network Software LiteSpeed / PHP/5.6.40 Resource Hash `b0930d980743bdb94662e2cb940f0d74731168397f0355519d7ad17407d1b69b` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 accept-language de-CH,de;q=0.9 Response headers alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-encoding br content-length 65 content-type text/html; charset=UTF-8 date Tue, 10 Oct 2023 08:42:48 GMT server LiteSpeed vary Accept-Encoding x-powered-by PHP/5.6.40 Redirect headers access-control-allow-origin https://l-k.io content-length 122 content-type text/html; charset=utf-8 date Tue, 10 Oct 2023 08:42:47 GMT location https://nakasacropscience.com/css/1.php strict-transport-security max-age=31536000; includeSubDomains; preload vary Origin, Accept x-content-type-options nosniff x-frame-options DENY x-powered-by Express x-xss-protection 1; mode=block
GET H/1.1	403 Forbidden	Primary Request CHFINAL Show response srv201002.hoster-test.ru/	299 B 562 B	314ms 83ms	Document text/html	31.28.24.131 HOSTING-MSK
General Check archive.org Show headers Download Go to Full URL http://srv201002.hoster-test.ru/CHFINAL Protocol HTTP/1.1 Server 31.28.24.131 St Petersburg, Russian Federation, ASN12616 (HOSTING-MSK, RU), Reverse DNS c06w.hoster.ru Software Apache/2.2.15 (CentOS) / Resource Hash `782c088cfa5fa79f679c60a3b8f4d0591b11aa02e424773ae79f8026481c2256` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 accept-language de-CH,de;q=0.9 Response headers Connection keep-alive Content-Length 299 Content-Type text/html; charset=iso-8859-1 Date Tue, 10 Oct 2023 08:42:49 GMT Server Apache/2.2.15 (CentOS) X-Cache MISS from t0.hoster.ru X-Cache-Lookup MISS from t0.hoster.ru:6666

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://srv201002.hoster-test.ru/CHFINAL Message: Failed to load resource: the server responded with a status of 403 (Forbidden)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

l-k.io
nakasacropscience.com
s.l-k.io
sendpost-37589.sptrackh.com
srv201002.hoster-test.ru
31.28.24.131
43.231.124.117
51.254.94.36
51.254.94.37
54.92.251.90
782c088cfa5fa79f679c60a3b8f4d0591b11aa02e424773ae79f8026481c2256
b0930d980743bdb94662e2cb940f0d74731168397f0355519d7ad17407d1b69b

srv201002.hoster-test.ru Open in urlscan Pro 31.28.24.131 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

2 Requests

50 %HTTPS

0 %IPv6

4 Domains

5 Subdomains

2 IPs

4 Countries

1 kBTransfer

0 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

srv201002.hoster-test.ru Open in urlscan Pro
31.28.24.131 Public Scan

Screenshot
Live screenshot

Full Image

2
Requests

50 %
HTTPS

0 %
IPv6

4
Domains

5
Subdomains

2
IPs

4
Countries

1 kB
Transfer

0 kB
Size

0
Cookies

2 HTTP transactions
0 data transactions