urlscan.io logo urlscan.io
SecurityTrails logo

crystalfiles.ru Open in urlscan Pro
2a00:f940:2:2:1:1:0:122  Public Scan

Go To Rescan Add Verdict Report
URL: http://crystalfiles.ru/
Submission: On January 09 via manual from SI — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 2 HTTP transactions. The main IP is 2a00:f940:2:2:1:1:0:122, located in Russian Federation and belongs to AS-REG, RU. The main domain is crystalfiles.ru.
This is the only time crystalfiles.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Downloads These files were downloaded by the website

dcrat-main.zip 21 MB application/zip
MIME: Zip archive data, at least v1.0 to extract
Size: 21 MB (22050767 bytes, 100% done)
Downloaded from: https://codeload.github.com/mvrtmv/dcrat/zip/refs/heads/main

Domain & IP information

IP Address AS Autonomous System
1 2a00:f940:2:2... 197695 (AS-REG)
1 1 140.82.121.3 36459 (GITHUB)
1 140.82.121.10 36459 (GITHUB)
2 2
Apex Domain
Subdomains		 Transfer
2 github.com
github.com — Cisco Umbrella Rank: 2566
codeload.github.com — Cisco Umbrella Rank: 57030
3 KB
1 crystalfiles.ru
crystalfiles.ru
348 B
2 2
Domain Requested by
1 codeload.github.com crystalfiles.ru
1 github.com 1 redirects
1 crystalfiles.ru
2 3

This site contains no links.

Subject Issuer Validity Valid
*.github.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2023-02-16 -
2024-03-15		 a year crt.sh

This page contains 1 frames:

Frame: https://codeload.github.com/mvrtmv/dcrat/zip/refs/heads/main
Frame ID: 4913CE18AF41693B152560B63CCDE6B8
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Statistics

2
Requests

50 %
HTTPS

33 %
IPv6

2
Domains

3
Subdomains

2
IPs

2
Countries

0 kB
Transfer

0 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://github.com/mvrtmv/dcrat/archive/refs/heads/main.zip HTTP 302
  • https://codeload.github.com/mvrtmv/dcrat/zip/refs/heads/main

2 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
crystalfiles.ru/ 		158 B
348 B 		Document
General
Check archive.org
Download Go to
Full URL
http://crystalfiles.ru/
Protocol
HTTP/1.1
Server
2a00:f940:2:2:1:1:0:122 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
Software
nginx /
Resource Hash
a8f67f50ac53786965ebef446d501a4a67080d0090325f24b77ce3f7e8c632fe

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html
Date
Tue, 09 Jan 2024 12:26:40 GMT
Server
nginx
Transfer-Encoding
chunked
Vary
Accept-Encoding
main
codeload.github.com/mvrtmv/dcrat/zip/refs/heads/
Redirect Chain
  • https://github.com/mvrtmv/dcrat/archive/refs/heads/main.zip
  • https://codeload.github.com/mvrtmv/dcrat/zip/refs/heads/main
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://codeload.github.com/mvrtmv/dcrat/zip/refs/heads/main
Requested by
Host: crystalfiles.ru
URL: http://crystalfiles.ru/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
140.82.121.10 Frankfurt am Main, Germany, ASN36459 (GITHUB, US),
Reverse DNS
lb-140-82-121-10-fra.github.com
Software
/
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

Referer
http://crystalfiles.ru/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-origin
https://render.githubusercontent.com
content-disposition
attachment; filename=dcrat-main.zip
content-length
22050767
content-security-policy
default-src 'none'; style-src 'unsafe-inline'; sandbox
content-type
application/zip
cross-origin-resource-policy
cross-origin
date
Tue, 09 Jan 2024 12:26:40 GMT
etag
W/"135ac4cedf3849b4bf05bcbcaae059ed33eeff0e209bd2a40b154bb514f50ca9"
strict-transport-security
max-age=31536000
vary
Authorization,Accept-Encoding,Origin
x-content-type-options
nosniff
x-frame-options
deny
x-github-request-id
D8A8:1FAE24:2ECC06:366373:659D3B80
x-xss-protection
1; mode=block

Redirect headers

cache-control
max-age=0, private
content-length
0
content-security-policy
default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events api.githubcopilot.com objects-origin.githubusercontent.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com support.github.com; img-src 'self' data: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/
content-type
text/html; charset=utf-8
date
Tue, 09 Jan 2024 12:26:40 GMT
location
https://codeload.github.com/mvrtmv/dcrat/zip/refs/heads/main
referrer-policy
no-referrer-when-downgrade
server
GitHub.com
strict-transport-security
max-age=31536000; includeSubdomains; preload
vary
X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
x-content-type-options
nosniff
x-frame-options
deny
x-github-request-id
D3B4:549B9:26AAE55:27158F1:659D3B80
x-xss-protection
0

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

codeload.github.com
crystalfiles.ru
github.com
140.82.121.10
140.82.121.3
2a00:f940:2:2:1:1:0:122
a8f67f50ac53786965ebef446d501a4a67080d0090325f24b77ce3f7e8c632fe