kohnurspat.xyz - urlscan.io

Summary

This website contacted 5 IPs in 4 countries across 6 domains to perform 6 HTTP transactions. The main IP is 34.196.13.28, located in Ashburn, United States and belongs to AMAZON-AES - Amazon.com, Inc., US. The main domain is kohnurspat.xyz.

This is the only time kohnurspat.xyz was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	190.2.150.129 190.2.150.129	49981 (WORLDSTREAM) (WORLDSTREAM)
1	108.161.188.132 108.161.188.132	12989 (HWNG) (HWNG)
1	2a00:1450:400... 2a00:1450:4001:821::200a	15169 (GOOGLE) (GOOGLE - Google LLC)
1	94.130.186.231 94.130.186.231	24940 (HETZNER-AS) (HETZNER-AS)
1 1	34.196.48.110 34.196.48.110	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
2	34.196.13.28 34.196.13.28	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
6	5

1 190.2.150.129 (Willemstad, Curacao)

ASN49981 (WORLDSTREAM, NL)
PTR: customer.worldstream.nl

190.2.150.129	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.161.188.132 (Los Angeles, United States)

ASN12989 (HWNG, NL)

trafficclub-nde.netdna-ssl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:821::200a (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 94.130.186.231 (Ukraine)

ASN24940 (HETZNER-AS, DE)
PTR: static.231.186.130.94.clients.your-server.de

track.traffic.club	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.196.48.110 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-196-48-110.compute-1.amazonaws.com

paramonos-oha.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.196.13.28 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-196-13-28.compute-1.amazonaws.com

quirkquayap.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
kohnurspat.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	kohnurspat.xyz kohnurspat.xyz	1 KB
1	quirkquayap.com quirkquayap.com	1 KB
1	paramonos-oha.com 1 redirects paramonos-oha.com	476 B
1	traffic.club track.traffic.club	423 B
1	googleapis.com ajax.googleapis.com	30 KB
1	netdna-ssl.com trafficclub-nde.netdna-ssl.com	3 KB
6	6

	Domain	Requested by
1	kohnurspat.xyz
1	quirkquayap.com	190.2.150.129
1	paramonos-oha.com	1 redirects
1	track.traffic.club	trafficclub-nde.netdna-ssl.com
1	ajax.googleapis.com	trafficclub-nde.netdna-ssl.com
1	trafficclub-nde.netdna-ssl.com	190.2.150.129
6	6

This site contains no links.

Subject Issuer	Validity	Valid
*.netdna-ssl.com COMODO RSA Domain Validation Secure Server CA	`2018-02-28` - `2019-02-28`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://kohnurspat.xyz/?k=0a88a92b5ac1d36a40557a3b83bb01f8.1538054099.920.2.1.cXVpcmtxdWF5YXAuY29t&subid=190.2.150.129&r=http%3A//190.2.150.129/&z=0
Frame ID: 1336F8DF0269B03B294723BD0225E2E0
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://190.2.150.129/ Page URL
http://paramonos-oha.com/190.2.150.129?adTagId=3c19c802-3e74-4143-9176-ed278599811a&cpm=0.02300&keywo... HTTP 302
http://quirkquayap.com/?subid=190.2.150.129 Page URL
http://kohnurspat.xyz/?k=0a88a92b5ac1d36a40557a3b83bb01f8.1538054099.920.2.1.cXVpcmtxdWF5YXAuY29t&... Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

6
Requests

17 %
HTTPS

17 %
IPv6

6
Domains

6
Subdomains

5
IPs

4
Countries

37 kB
Transfer

93 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://190.2.150.129/ Page URL
http://paramonos-oha.com/190.2.150.129?adTagId=3c19c802-3e74-4143-9176-ed278599811a&cpm=0.02300&keywords=movies,videos&fallbackUrl=http%3A%2F%2Fquirkquayap.com%2F%3Fsubid%3D190.2.150.129 HTTP 302
http://quirkquayap.com/?subid=190.2.150.129 Page URL
http://kohnurspat.xyz/?k=0a88a92b5ac1d36a40557a3b83bb01f8.1538054099.920.2.1.cXVpcmtxdWF5YXAuY29t&subid=190.2.150.129&r=http%3A//190.2.150.129/&z=0 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4

http://paramonos-oha.com/190.2.150.129?adTagId=3c19c802-3e74-4143-9176-ed278599811a&cpm=0.02300&keywords=movies,videos&fallbackUrl=http%3A%2F%2Fquirkquayap.com%2F%3Fsubid%3D190.2.150.129 HTTP 302
http://quirkquayap.com/?subid=190.2.150.129

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK / Show response
190.2.150.129/ 856 B
1 KB 25ms
13ms Document
text/html 190.2.150.129
WORLDSTREAM

General

Check archive.org

Show headers Download Go to

Full URL: http://190.2.150.129/
Protocol: HTTP/1.1
Server: 190.2.150.129 Willemstad, Curacao, ASN49981 (WORLDSTREAM, NL),
Reverse DNS: customer.worldstream.nl
Software: nginx/1.10.2 / PHP/5.3.3
Resource Hash: 60a4fd2f987154e572a90e032e6e83db53ef9c002d97122bff1661d05e866a3b

Request headers

Host: 190.2.150.129
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Server: nginx/1.10.2
Date: Thu, 27 Sep 2018 13:15:50 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3

GET
S 200 rtb.min.js Show response
trafficclub-nde.netdna-ssl.com/ 8 KB
3 KB 23ms
6ms Script
application/javascript 108.161.188.132
HWNG

General

Check archive.org

Show headers Download Go to

Full URL: https://trafficclub-nde.netdna-ssl.com/rtb.min.js
Requested by: Host: 190.2.150.129
URL: http://190.2.150.129/
Protocol: SPDY
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.132 Los Angeles, United States, ASN12989 (HWNG, NL),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 0a8e88cef280ebf0c394920cb5997eea3509e6c844555452cd4b121097e6e747

Request headers

Referer: http://190.2.150.129/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Thu, 27 Sep 2018 13:14:59 GMT
content-encoding: gzip
last-modified: Thu, 23 Nov 2017 07:07:54 GMT
server: NetDNA-cache/2.2
etag: W/"1e4d-55ea1184d0680"
x-cache: HIT
content-type: application/javascript
status: 200

GET
H/1.1 200
OK jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/2.2.0/ 84 KB
30 KB 11ms
5ms Script
text/javascript 2a00:1450:4001:821::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

http://ajax.googleapis.com/ajax/libs/jquery/2.2.0/jquery.min.js

Requested by

Host: trafficclub-nde.netdna-ssl.com
URL: https://trafficclub-nde.netdna-ssl.com/rtb.min.js

Protocol

HTTP/1.1

Server

2a00:1450:4001:821::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

8a102873a33f24f7eb22221e6b23c4f718e29f85168ecc769a35bfaed9b12cce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://190.2.150.129/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Fri, 21 Sep 2018 01:06:07 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Tue, 20 Dec 2016 18:17:03 GMT
Server: sffe
Age: 562132
Vary: Accept-Encoding
Content-Type: text/javascript; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000, stale-while-revalidate=2592000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 30089
X-XSS-Protection: 1; mode=block
Expires: Sat, 21 Sep 2019 01:06:07 GMT

GET
H/1.1 200
OK rtb.php Show response
track.traffic.club/ 32 B
423 B 39ms
35ms XHR
text/html 94.130.186.231
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

http://track.traffic.club/rtb.php?hash=f11a0867b4d0cd65808eeaea2f270f9c&mid=185&f=185&request=rtb&keyword=....&domain=190.2.150.129

Requested by

Host: trafficclub-nde.netdna-ssl.com
URL: https://trafficclub-nde.netdna-ssl.com/rtb.min.js

Protocol

HTTP/1.1

Server

94.130.186.231 , Ukraine, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.231.186.130.94.clients.your-server.de

Software

nginx /

Resource Hash

3d9e41693ee6519a83134d78773895f5f921fb0158a91c83613321e490d9c13a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: http://190.2.150.129/
Origin: http://190.2.150.129

Response headers

Date: Thu, 27 Sep 2018 13:14:59 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Vary: Accept-Encoding
Content-Type: text/html; charset=utf8
Access-Control-Allow-Origin: *
Cache-Control: no-cache, must-revalidate
Transfer-Encoding: chunked
Connection: keep-alive
X-XSS-Protection: 1; mode=block

GET
H/1.1

200
OK

/ Show response
quirkquayap.com/
Redirect Chain

http://paramonos-oha.com/190.2.150.129?adTagId=3c19c802-3e74-4143-9176-ed278599811a&cpm=0.02300&keywords=movies,videos&fallbackUrl=http%3A%2F%2Fquirkquayap.com%2F%3Fsubid%3D190.2.150.129
http://quirkquayap.com/?subid=190.2.150.129

998 B
1 KB

193ms
96ms

Document
text/html

34.196.13.28
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

http://quirkquayap.com/?subid=190.2.150.129

Requested by

Host: 190.2.150.129
URL: http://190.2.150.129/

Protocol

HTTP/1.1

Server

34.196.13.28 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-34-196-13-28.compute-1.amazonaws.com

Software

nginx /

Resource Hash

7b6d07b2e806ff62668c0c45bcc9179c96a0f6c0cd5a70acc49069e96b236e18

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Host: quirkquayap.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://190.2.150.129/
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: http://190.2.150.129/

Response headers

Server: nginx
Date: Thu, 27 Sep 2018 13:14:59 GMT
Content-Type: text/html
Content-Length: 998
Connection: close
Expires: Mon, 31 Dec 2001 23:59:59 GMT
Pragma: no-cache
Cache-Control: no-store, no-cache, pre-check=0, post-check=0
X-Content-Type-Options: nosniff

Redirect headers

Cache-Control: no-store, no-cache, pre-check=0, post-check=0
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
Date: Thu, 27 Sep 2018 13:14:59 GMT
Location: http://quirkquayap.com/?subid=190.2.150.129
Server: ZeroPark-Traffic
x-content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
X-WebKit-CSP: default-src 'self'; script-src 'self' 'unsafe-inline'
Content-Length: 0
Connection: keep-alive

GET
H/1.1 200
OK Primary Request Cookie set / Show response
kohnurspat.xyz/ 415 B
1 KB 203ms
104ms Document
text/html 34.196.13.28
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: http://kohnurspat.xyz/?k=0a88a92b5ac1d36a40557a3b83bb01f8.1538054099.920.2.1.cXVpcmtxdWF5YXAuY29t&subid=190.2.150.129&r=http%3A//190.2.150.129/&z=0
Protocol: HTTP/1.1
Server: 34.196.13.28 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-34-196-13-28.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 26c0b7bd93a6d20d75f9027c582602b42c8197536208422faf9e13a092f2709f

Request headers

Host: kohnurspat.xyz
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Server: nginx
Date: Thu, 27 Sep 2018 13:15:00 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Set-Cookie: tpp_u=0%3B1538140500; expires=Sat, 29-Sep-2018 13:15:00 GMT; path=/ tpp_6519840_l=16%3B1538140500; expires=Sat, 29-Sep-2018 13:15:00 GMT; path=/ tpp_ov=102652%3B1538140500; expires=Sat, 29-Sep-2018 13:15:00 GMT; path=/ tpp_ov=102652%2C102970%3B1538140500; expires=Sat, 29-Sep-2018 13:15:00 GMT; path=/ tpp_oc=102970%3B1538140500; expires=Sat, 29-Sep-2018 13:15:00 GMT; path=/
Expires: Mon, 31 Dec 2001 23:59:59 GMT
Pragma: no-cache

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
kohnurspat.xyz/	1970-01-18 19:17:06	Name: tpp_oc Value: 102970%3B1538140500
kohnurspat.xyz/	1970-01-18 19:17:06	Name: tpp_6519840_l Value: 16%3B1538140500
kohnurspat.xyz/	1970-01-18 19:17:06	Name: tpp_ov Value: 102652%2C102970%3B1538140500
kohnurspat.xyz/	1970-01-18 19:17:06	Name: tpp_u Value: 0%3B1538140500

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://trafficclub-nde.netdna-ssl.com/rtb.min.js(Line 1) Message: [object Object]
console-api	log	URL: https://trafficclub-nde.netdna-ssl.com/rtb.min.js(Line 1) Message: 1
console-api	log	URL: https://trafficclub-nde.netdna-ssl.com/rtb.min.js(Line 1) Message: 1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
kohnurspat.xyz
paramonos-oha.com
quirkquayap.com
track.traffic.club
trafficclub-nde.netdna-ssl.com
108.161.188.132
190.2.150.129
2a00:1450:4001:821::200a
34.196.13.28
34.196.48.110
94.130.186.231
0a8e88cef280ebf0c394920cb5997eea3509e6c844555452cd4b121097e6e747
26c0b7bd93a6d20d75f9027c582602b42c8197536208422faf9e13a092f2709f
3d9e41693ee6519a83134d78773895f5f921fb0158a91c83613321e490d9c13a
60a4fd2f987154e572a90e032e6e83db53ef9c002d97122bff1661d05e866a3b
7b6d07b2e806ff62668c0c45bcc9179c96a0f6c0cd5a70acc49069e96b236e18
8a102873a33f24f7eb22221e6b23c4f718e29f85168ecc769a35bfaed9b12cce

kohnurspat.xyz Open in urlscan Pro 34.196.13.28 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

17 %HTTPS

17 %IPv6

6 Domains

6 Subdomains

5 IPs

4 Countries

37 kBTransfer

93 kBSize

4 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

4 Cookies

3 Console Messages

Indicators

kohnurspat.xyz Open in urlscan Pro
34.196.13.28 Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

17 %
HTTPS

17 %
IPv6

6
Domains

6
Subdomains

5
IPs

4
Countries

37 kB
Transfer

93 kB
Size

4
Cookies

6 HTTP transactions
0 data transactions