URL: https://au.well.ru/login.php
Submission Tags: krdprod
Submission: On October 24 via api from JP — Scanned from DE

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 19 HTTP transactions. The main IP is 136.243.101.147, located in Germany and belongs to HETZNER-AS, DE. The main domain is au.well.ru.
TLS certificate: Issued by R3 on August 25th 2021. Valid for: 3 months.
This is the only time au.well.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
10 136.243.101.147 24940 (HETZNER-AS)
1 142.250.185.106 15169 (GOOGLE)
2 176.34.176.48 16509 (AMAZON-02)
6 142.250.186.99 15169 (GOOGLE)
19 4
Apex Domain
Subdomains
Transfer
10 well.ru
au.well.ru
294 KB
6 gstatic.com
fonts.gstatic.com
76 KB
2 bitrix.info
bitrix.info
4 KB
1 googleapis.com
fonts.googleapis.com
1 KB
19 4
Domain Requested by
10 au.well.ru au.well.ru
6 fonts.gstatic.com fonts.googleapis.com
2 bitrix.info au.well.ru
bitrix.info
1 fonts.googleapis.com au.well.ru
19 4

This site contains no links.

Subject Issuer Validity Valid
au.well.ru
R3
2021-08-25 -
2021-11-23
3 months crt.sh
upload.video.google.com
GTS CA 1C3
2021-10-04 -
2021-12-27
3 months crt.sh
*.bitrix.info
Go Daddy Secure Certificate Authority - G2
2020-02-14 -
2022-04-14
2 years crt.sh
*.gstatic.com
GTS CA 1C3
2021-10-04 -
2021-12-27
3 months crt.sh

This page contains 1 frames:

Primary Page: https://au.well.ru/login.php
Frame ID: A5B7450221CBACC467D4ACC8156C5E28
Requests: 19 HTTP requests in this frame

Screenshot

Page Title

Велл Турадмин, вход для агентств ВЕЛЛ

Detected technologies

Overall confidence: 100%
Detected patterns
  • (?:<link[^>]+components/bitrix|(?:src|href)="/bitrix/(?:js|templates))

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

19
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

375 kB
Transfer

381 kB
Size

3
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request login.php
au.well.ru/
5 KB
3 KB
Document
General
Full URL
https://au.well.ru/login.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
136.243.101.147 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
web.well.ru
Software
nginx/1.20.1 / PHP/7.4.22
Resource Hash
025b937b95aef97f986bf4e3fb23c47790cdbb224ab2f30be69ed05bc2f73cb6

Request headers

:method
GET
:authority
au.well.ru
:scheme
https
:path
/login.php
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

server
nginx/1.20.1
date
Sun, 24 Oct 2021 08:52:11 GMT
content-type
text/html; charset=windows-1251
x-powered-by
PHP/7.4.22
p3p
policyref="/bitrix/p3p.xml", CP="NON DSP COR CUR ADM DEV PSA PSD OUR UNR BUS UNI COM NAV INT DEM STA"
x-powered-cms
Bitrix Site Manager (6d05dfd2fdc0620e3b0d11cdf260545f)
set-cookie
PHPSESSID=f32q7buf1u4fb4t9l0f0lhituv; path=/; domain=au.well.ru; HttpOnly
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
content-encoding
gzip
core.css
au.well.ru/bitrix/js/main/core/css/
4 KB
4 KB
Stylesheet
General
Full URL
https://au.well.ru/bitrix/js/main/core/css/core.css?14320137453963
Requested by
Host: au.well.ru
URL: https://au.well.ru/login.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
136.243.101.147 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
web.well.ru
Software
nginx/1.20.1 /
Resource Hash
906159ed7c4e25e4b20f5e7754ff5e4f2f6d848bd0d7ea02581feccc08bdbde3

Request headers

:path
/bitrix/js/main/core/css/core.css?14320137453963
pragma
no-cache
cookie
PHPSESSID=f32q7buf1u4fb4t9l0f0lhituv
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
au.well.ru
referer
https://au.well.ru/login.php
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://au.well.ru/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Sun, 24 Oct 2021 08:52:11 GMT
last-modified
Tue, 19 May 2015 05:35:45 GMT
server
nginx/1.20.1
accept-ranges
bytes
etag
"555acbb1-f7b"
content-length
3963
content-type
text/css
popup.css
au.well.ru/bitrix/panel/main/
23 KB
23 KB
Stylesheet
General
Full URL
https://au.well.ru/bitrix/panel/main/popup.css?152231918923092
Requested by
Host: au.well.ru
URL: https://au.well.ru/login.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
136.243.101.147 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
web.well.ru
Software
nginx/1.20.1 /
Resource Hash
41b980eed4502ad8f8d11a396b13a9ccadc6fda7f2d2d673d6f55f2de8c30afd

Request headers

:path
/bitrix/panel/main/popup.css?152231918923092
pragma
no-cache
cookie
PHPSESSID=f32q7buf1u4fb4t9l0f0lhituv
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
au.well.ru
referer
https://au.well.ru/login.php
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://au.well.ru/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Sun, 24 Oct 2021 08:52:11 GMT
last-modified
Thu, 29 Mar 2018 10:26:29 GMT
server
nginx/1.20.1
accept-ranges
bytes
etag
"5abcbf55-5a34"
content-length
23092
content-type
text/css
style.css
au.well.ru/local/templates/well_auth/components/bitrix/system.auth.authorize/.default/
2 KB
2 KB
Stylesheet
General
Full URL
https://au.well.ru/local/templates/well_auth/components/bitrix/system.auth.authorize/.default/style.css?15827314612155
Requested by
Host: au.well.ru
URL: https://au.well.ru/login.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
136.243.101.147 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
web.well.ru
Software
nginx/1.20.1 /
Resource Hash
944d504306fb9ed5f94380ddf7ba3e8368f75be64a2e3c111bbeece212b52c4e

Request headers

:path
/local/templates/well_auth/components/bitrix/system.auth.authorize/.default/style.css?15827314612155
pragma
no-cache
cookie
PHPSESSID=f32q7buf1u4fb4t9l0f0lhituv
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
au.well.ru
referer
https://au.well.ru/login.php
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://au.well.ru/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Sun, 24 Oct 2021 08:52:11 GMT
last-modified
Wed, 26 Feb 2020 15:37:41 GMT
server
nginx/1.20.1
accept-ranges
bytes
etag
"5e5690c5-86b"
content-length
2155
content-type
text/css
core.js
au.well.ru/bitrix/js/main/core/
115 KB
115 KB
Script
General
Full URL
https://au.well.ru/bitrix/js/main/core/core.js?1481606389117883
Requested by
Host: au.well.ru
URL: https://au.well.ru/login.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
136.243.101.147 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
web.well.ru
Software
nginx/1.20.1 /
Resource Hash
ed7aa24d03dcd0b1ec6a146acbb2178e6ed8dc8435a906182458fdfcf3d33f93

Request headers

:path
/bitrix/js/main/core/core.js?1481606389117883
pragma
no-cache
cookie
PHPSESSID=f32q7buf1u4fb4t9l0f0lhituv
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
au.well.ru
referer
https://au.well.ru/login.php
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://au.well.ru/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Sun, 24 Oct 2021 08:52:11 GMT
last-modified
Tue, 13 Dec 2016 05:19:49 GMT
server
nginx/1.20.1
accept-ranges
bytes
etag
"584f84f5-1cc7b"
content-length
117883
content-type
application/javascript
core_ajax.js
au.well.ru/bitrix/js/main/core/
35 KB
35 KB
Script
General
Full URL
https://au.well.ru/bitrix/js/main/core/core_ajax.js?147125256435602
Requested by
Host: au.well.ru
URL: https://au.well.ru/login.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
136.243.101.147 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
web.well.ru
Software
nginx/1.20.1 /
Resource Hash
51bd3178c7fdc8be949dadaa4d982b50ed3f793164398db59a72b34223114d39

Request headers

:path
/bitrix/js/main/core/core_ajax.js?147125256435602
pragma
no-cache
cookie
PHPSESSID=f32q7buf1u4fb4t9l0f0lhituv
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
au.well.ru
referer
https://au.well.ru/login.php
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://au.well.ru/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Sun, 24 Oct 2021 08:52:11 GMT
last-modified
Mon, 15 Aug 2016 09:16:04 GMT
server
nginx/1.20.1
accept-ranges
bytes
etag
"57b18854-8b12"
content-length
35602
content-type
application/javascript
core_window.js
au.well.ru/bitrix/js/main/core/
94 KB
95 KB
Script
General
Full URL
https://au.well.ru/bitrix/js/main/core/core_window.js?146364333996650
Requested by
Host: au.well.ru
URL: https://au.well.ru/login.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
136.243.101.147 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
web.well.ru
Software
nginx/1.20.1 /
Resource Hash
85aab2905b845ef15abbb1fb54718e36624fdb63a7955b9ec2ce490fc12391a7

Request headers

:path
/bitrix/js/main/core/core_window.js?146364333996650
pragma
no-cache
cookie
PHPSESSID=f32q7buf1u4fb4t9l0f0lhituv
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
au.well.ru
referer
https://au.well.ru/login.php
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://au.well.ru/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Sun, 24 Oct 2021 08:52:11 GMT
last-modified
Thu, 19 May 2016 07:35:39 GMT
server
nginx/1.20.1
accept-ranges
bytes
etag
"573d6ccb-1798a"
content-length
96650
content-type
application/javascript
script.js
au.well.ru/local/templates/well_auth/components/bitrix/system.auth.authorize/.default/
511 B
647 B
Script
General
Full URL
https://au.well.ru/local/templates/well_auth/components/bitrix/system.auth.authorize/.default/script.js?1573742103511
Requested by
Host: au.well.ru
URL: https://au.well.ru/login.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
136.243.101.147 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
web.well.ru
Software
nginx/1.20.1 /
Resource Hash
ad1856114d4ca85a2e5f28a7296e7f6556c7a4995a6a692957f7fc4e309504d5

Request headers

:path
/local/templates/well_auth/components/bitrix/system.auth.authorize/.default/script.js?1573742103511
pragma
no-cache
cookie
PHPSESSID=f32q7buf1u4fb4t9l0f0lhituv
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
au.well.ru
referer
https://au.well.ru/login.php
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://au.well.ru/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Sun, 24 Oct 2021 08:52:11 GMT
last-modified
Thu, 14 Nov 2019 14:35:03 GMT
server
nginx/1.20.1
accept-ranges
bytes
etag
"5dcd6617-1ff"
content-length
511
content-type
application/javascript
logo.jpg
au.well.ru/local/templates/well_auth/components/bitrix/system.auth.authorize/.default/images/
16 KB
16 KB
Image
General
Full URL
https://au.well.ru/local/templates/well_auth/components/bitrix/system.auth.authorize/.default/images/logo.jpg
Requested by
Host: au.well.ru
URL: https://au.well.ru/login.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
136.243.101.147 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
web.well.ru
Software
nginx/1.20.1 /
Resource Hash
cbcb078f08c50a63791049738072ada3e615585fab234eb3d3f2a0134483139b

Request headers

:path
/local/templates/well_auth/components/bitrix/system.auth.authorize/.default/images/logo.jpg
pragma
no-cache
cookie
PHPSESSID=f32q7buf1u4fb4t9l0f0lhituv
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
au.well.ru
referer
https://au.well.ru/login.php
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://au.well.ru/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Sun, 24 Oct 2021 08:52:11 GMT
last-modified
Mon, 21 Oct 2019 19:42:27 GMT
server
nginx/1.20.1
accept-ranges
bytes
etag
"5dae0a23-3fe8"
content-length
16360
content-type
image/jpeg
eye.svg
au.well.ru/local/templates/well_auth/components/bitrix/system.auth.authorize/.default/images/
384 B
513 B
Image
General
Full URL
https://au.well.ru/local/templates/well_auth/components/bitrix/system.auth.authorize/.default/images/eye.svg
Requested by
Host: au.well.ru
URL: https://au.well.ru/login.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
136.243.101.147 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
web.well.ru
Software
nginx/1.20.1 /
Resource Hash
bcbec0215f79d2834b04a079cbab338ceb78f983c9ccd3f77bc8c5cc619e577e

Request headers

:path
/local/templates/well_auth/components/bitrix/system.auth.authorize/.default/images/eye.svg
pragma
no-cache
cookie
PHPSESSID=f32q7buf1u4fb4t9l0f0lhituv
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
au.well.ru
referer
https://au.well.ru/login.php
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://au.well.ru/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Sun, 24 Oct 2021 08:52:11 GMT
last-modified
Wed, 20 Nov 2019 21:30:18 GMT
server
nginx/1.20.1
accept-ranges
bytes
etag
"5dd5b06a-180"
content-length
384
content-type
image/svg+xml
css
fonts.googleapis.com/
6 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Roboto:400,500,700
Requested by
Host: au.well.ru
URL: https://au.well.ru/local/templates/well_auth/components/bitrix/system.auth.authorize/.default/style.css?15827314612155
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.106 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s49-in-f10.1e100.net
Software
ESF /
Resource Hash
cf624cca88c1828e4dc1a61151d2ce6e826191ba2223f4cf4cdacc1d8a52981b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://au.well.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection
0
last-modified
Sun, 24 Oct 2021 07:47:33 GMT
server
ESF
date
Sun, 24 Oct 2021 08:52:11 GMT
x-frame-options
SAMEORIGIN
report-to
{"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only
same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires
Sun, 24 Oct 2021 08:52:11 GMT
ba.js
bitrix.info/
7 KB
3 KB
Script
General
Full URL
https://bitrix.info/ba.js
Requested by
Host: au.well.ru
URL: https://au.well.ru/login.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
176.34.176.48 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-176-34-176-48.eu-west-1.compute.amazonaws.com
Software
nginx/1.10.1 /
Resource Hash
897c58672b375fd206d4df4ccd71a3fa3e29f739f4db5251b94895ad015f9710

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://au.well.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Sun, 24 Oct 2021 08:52:11 GMT
Content-Encoding
gzip
Last-Modified
Wed, 19 May 2021 09:38:44 GMT
Server
nginx/1.10.1
ETag
W/"60a4dca4-1a03"
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Access-Control-Allow-Origin
*
Cache-Control
max-age=172800
Connection
keep-alive
Content-Type
application/javascript
Content-Length
3008
Expires
Tue, 26 Oct 2021 08:52:11 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/
15 KB
16 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.99 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f3.1e100.net
Software
sffe /
Resource Hash
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://au.well.ru
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 16:31:41 GMT
x-content-type-options
nosniff
age
318030
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
15688
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:19 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Thu, 20 Oct 2022 16:31:41 GMT
KFOlCnqEu92Fr1MmEU9fABc4EsA.woff2
fonts.gstatic.com/s/roboto/v29/
10 KB
10 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmEU9fABc4EsA.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.99 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f3.1e100.net
Software
sffe /
Resource Hash
2d2ad11e3c1a0fd81bb085050d4b3170beab2964b5b848a5309a6343322e3898
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://au.well.ru
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 21 Oct 2021 19:34:03 GMT
x-content-type-options
nosniff
age
220688
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
9776
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:26 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Fri, 21 Oct 2022 19:34:03 GMT
KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2
fonts.gstatic.com/s/roboto/v29/
9 KB
9 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.99 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f3.1e100.net
Software
sffe /
Resource Hash
053508cc4ed1acf7db8ed96deca42ffebfa1669c5cecd62f4415b926d07b5aaa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://au.well.ru
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 22 Oct 2021 04:39:47 GMT
x-content-type-options
nosniff
age
187944
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
9544
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:33 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Sat, 22 Oct 2022 04:39:47 GMT
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/
16 KB
16 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.99 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f3.1e100.net
Software
sffe /
Resource Hash
bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://au.well.ru
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 22 Oct 2021 02:46:35 GMT
x-content-type-options
nosniff
age
194736
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
15920
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:21 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Sat, 22 Oct 2022 02:46:35 GMT
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/
15 KB
16 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.99 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f3.1e100.net
Software
sffe /
Resource Hash
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://au.well.ru
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 22 Oct 2021 01:55:14 GMT
x-content-type-options
nosniff
age
197817
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
15828
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:28 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Sat, 22 Oct 2022 01:55:14 GMT
KFOmCnqEu92Fr1Mu5mxKOzY.woff2
fonts.gstatic.com/s/roboto/v29/
9 KB
10 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu5mxKOzY.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.99 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f3.1e100.net
Software
sffe /
Resource Hash
8dd3b91ca60e6a0486326c5c275590dd1d753240c2efa9f94730815813997fee
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://au.well.ru
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 03:41:26 GMT
x-content-type-options
nosniff
age
364245
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
9688
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:21 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Thu, 20 Oct 2022 03:41:26 GMT
bx_stat
bitrix.info/
42 B
533 B
XHR
General
Full URL
https://bitrix.info/bx_stat
Requested by
Host: bitrix.info
URL: https://bitrix.info/ba.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
176.34.176.48 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-176-34-176-48.eu-west-1.compute.amazonaws.com
Software
nginx/1.10.1 /
Resource Hash
62b9ef121368de0c174a732b9430bb1ba7e7ae0d7d5bcb2d403cc26585262b54

Request headers

Referer
https://au.well.ru/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Date
Sun, 24 Oct 2021 08:52:11 GMT
Server
nginx/1.10.1
ETag
b1e7f89fc6a12db319bd10f05b62653c
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Access-Control-Allow-Origin
https://au.well.ru
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/javascript
Content-Length
42

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster function| BX object| _ba function| _ba_punycode object| _baq

3 Cookies

Domain/Path Name / Value
.au.well.ru/ Name: PHPSESSID
Value: f32q7buf1u4fb4t9l0f0lhituv
.bitrix.info/ Name: bx_user_id
Value: b1e7f89fc6a12db319bd10f05b62653c
au.well.ru/ Name: BX_USER_ID
Value: b1e7f89fc6a12db319bd10f05b62653c

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

au.well.ru
bitrix.info
fonts.googleapis.com
fonts.gstatic.com
136.243.101.147
142.250.185.106
142.250.186.99
176.34.176.48
025b937b95aef97f986bf4e3fb23c47790cdbb224ab2f30be69ed05bc2f73cb6
053508cc4ed1acf7db8ed96deca42ffebfa1669c5cecd62f4415b926d07b5aaa
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
2d2ad11e3c1a0fd81bb085050d4b3170beab2964b5b848a5309a6343322e3898
41b980eed4502ad8f8d11a396b13a9ccadc6fda7f2d2d673d6f55f2de8c30afd
51bd3178c7fdc8be949dadaa4d982b50ed3f793164398db59a72b34223114d39
62b9ef121368de0c174a732b9430bb1ba7e7ae0d7d5bcb2d403cc26585262b54
85aab2905b845ef15abbb1fb54718e36624fdb63a7955b9ec2ce490fc12391a7
897c58672b375fd206d4df4ccd71a3fa3e29f739f4db5251b94895ad015f9710
8dd3b91ca60e6a0486326c5c275590dd1d753240c2efa9f94730815813997fee
906159ed7c4e25e4b20f5e7754ff5e4f2f6d848bd0d7ea02581feccc08bdbde3
944d504306fb9ed5f94380ddf7ba3e8368f75be64a2e3c111bbeece212b52c4e
ad1856114d4ca85a2e5f28a7296e7f6556c7a4995a6a692957f7fc4e309504d5
bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f
bcbec0215f79d2834b04a079cbab338ceb78f983c9ccd3f77bc8c5cc619e577e
cbcb078f08c50a63791049738072ada3e615585fab234eb3d3f2a0134483139b
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
cf624cca88c1828e4dc1a61151d2ce6e826191ba2223f4cf4cdacc1d8a52981b
ed7aa24d03dcd0b1ec6a146acbb2178e6ed8dc8435a906182458fdfcf3d33f93