Submitted URL: https://h2oproclean.com.au/fi.php
Effective URL: https://portal-foractiviy.ru/fidi
Submission: On April 02 via manual from US — Scanned from AU

Summary

This website contacted 1 IPs in 1 countries across 2 domains to perform 7 HTTP transactions. The main IP is 172.67.128.128, located in United States and belongs to CLOUDFLARENET, US. The main domain is portal-foractiviy.ru.
TLS certificate: Issued by E1 on March 22nd 2024. Valid for: 3 months.
This is the only time portal-foractiviy.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 172.67.167.114 13335 (CLOUDFLAR...)
1 8 172.67.128.128 13335 (CLOUDFLAR...)
7 1
Apex Domain
Subdomains
Transfer
8 portal-foractiviy.ru
portal-foractiviy.ru
16 KB
1 h2oproclean.com.au
h2oproclean.com.au
496 B
7 2
Domain Requested by
8 portal-foractiviy.ru 1 redirects portal-foractiviy.ru
1 h2oproclean.com.au 1 redirects
7 2

This site contains no links.

Subject Issuer Validity Valid
portal-foractiviy.ru
E1
2024-03-22 -
2024-06-20
3 months crt.sh

This page contains 2 frames:

Primary Page: https://portal-foractiviy.ru/fidi
Frame ID: ADA7B3E6CE1E630CC6199EA5154E809F
Requests: 5 HTTP requests in this frame

Frame: https://portal-foractiviy.ru/cdn-cgi/challenge-platform/h/g/scripts/jsd/dc6b543c1346/main.js
Frame ID: 5A72F865CE065AC62F0D34B01FAEFC02
Requests: 2 HTTP requests in this frame

Screenshot

Page Title

404 Not Found

Page URL History Show full URLs

  1. https://h2oproclean.com.au/fi.php HTTP 302
    https://portal-foractiviy.ru/fidi Page URL
  2. https://portal-foractiviy.ru/fidi Page URL

Page Statistics

7
Requests

86 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

1
Countries

16 kB
Transfer

16 kB
Size

9
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://h2oproclean.com.au/fi.php HTTP 302
    https://portal-foractiviy.ru/fidi Page URL
  2. https://portal-foractiviy.ru/fidi Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://h2oproclean.com.au/fi.php HTTP 302
  • https://portal-foractiviy.ru/fidi
Request Chain 2
  • https://portal-foractiviy.ru/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
  • https://portal-foractiviy.ru/cdn-cgi/challenge-platform/h/g/scripts/jsd/dc6b543c1346/main.js

7 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
fidi
portal-foractiviy.ru/
Redirect Chain
  • https://h2oproclean.com.au/fi.php
  • https://portal-foractiviy.ru/fidi
7 KB
8 KB
Document
General
Full URL
https://portal-foractiviy.ru/fidi
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.128.128 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
caf66df3a683f9c28203bc517f6993bc20a3e987ae1197ca7ad4b0f2fefc97b1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language
en-AU,en;q=0.9
sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
public, max-age=0 no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-cache-status
DYNAMIC
cf-ray
86e193077d96a96d-SYD
content-type
text/html; charset=utf-8
date
Tue, 02 Apr 2024 14:40:29 GMT
expires
0
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9U4qnUYKmGEAcFfcht9vSLT6aCC0ce6Z5ppIFT806Ph96WheziIzmwHyihKNeM%2B0FRNOaOd5KtP1YQwI76LM8KzxIs2A5Z5UFAqrY%2FLMTJq0UnJhvnabk5WWHbgOISKlYJHLWvdlLA%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block 1; mode=block

Redirect headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
86e19302ab84ab01-SYD
content-type
text/html; charset=UTF-8
date
Tue, 02 Apr 2024 14:40:28 GMT
location
https://portal-foractiviy.ru/fidi
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cSKi41yp%2BrQijx7KrCE6iBaSYpsE3vbV0imICu%2BtpFtEawLHsieBQbU0ZCR%2FLPx1hFtZL7aViYOjCdYKlVhnwz6KeqxOS2DMGFrP%2BpuGEUD2GH0PKdYdsl7sx2j2f0nP9QXFB8k%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-powered-by
PHP/7.4.33
fidi
portal-foractiviy.ru/
0
824 B
XHR
General
Full URL
https://portal-foractiviy.ru/fidi
Requested by
Host: portal-foractiviy.ru
URL: https://portal-foractiviy.ru/fidi
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.128.128 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block, 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
4anurZBV-NVjjpwygGXl7kVE2co
21282425
X-Requested-TimeStamp-Expire
accept-language
en-AU,en;q=0.9
sec-ch-ua-mobile
?0
X-Requested-TimeStamp-Combination
X-Requested-Type-Combination
GET
Content-type
application/x-www-form-urlencoded
X-Requested-Type
GET
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Referer
https://portal-foractiviy.ru/fidi
X-Requested-with
XMLHttpRequest
X-Requested-TimeStamp
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Tue, 02 Apr 2024 14:40:30 GMT
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l2Es6XUVHF3DPW6QRE0871TLQ%2FwjPuP%2FKr9pE0OafeClFjzP5Q2FRYwNxh76DSbDvK52%2B5UR2mRBxTdjcHHgBK7Hm%2BAJsLd7QFOUM%2BLisU9vusWC%2BnK8dZ911%2Fo2HtcXEdX0f8qK5Q%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=0 no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
86e1930b7f29a96d-SYD
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block, 1; mode=block
expires
0
main.js
portal-foractiviy.ru/cdn-cgi/challenge-platform/h/g/scripts/jsd/dc6b543c1346/ Frame 5A72
Redirect Chain
  • https://portal-foractiviy.ru/cdn-cgi/challenge-platform/scripts/jsd/main.js
  • https://portal-foractiviy.ru/cdn-cgi/challenge-platform/h/g/scripts/jsd/dc6b543c1346/main.js
8 KB
4 KB
Script
General
Full URL
https://portal-foractiviy.ru/cdn-cgi/challenge-platform/h/g/scripts/jsd/dc6b543c1346/main.js
Protocol
H3
Server
172.67.128.128 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
892696405ed5e9d06d7c875ac5c678f3ad79cb29234fd69175cb4a8db2b9665c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-AU,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

date
Tue, 02 Apr 2024 14:40:30 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Rr7kRrBimiMPg5YFkyFX%2FNPf6NTJPTg%2B1n1A57zWYgLmfOJw5CBjoUPmueIcjR3OOMEMFI1hxlSpHARkc6m4FI8fUxfkhrKX6V8O3iG9VfHFHypf8fUvdVwN%2FgnYX%2FDJnKXRytSecw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400, public
cf-ray
86e1930b8f30a96d-SYD
alt-svc
h3=":443"; ma=86400

Redirect headers

date
Tue, 02 Apr 2024 14:40:30 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HU3sSzifXPzb3znw1MtNwnaYzSLWL89WHKDqPTNPHiZMnIGA68RALBqEkwk81ST13pp0nejHlby7aT1QhGEBtl0hU%2BXB21yawZ2UowPJSC9Klwur8w%2B%2FGMl4Z9QMYKd9y4tsM%2FU3tw%3D%3D"}],"group":"cf-nel","max_age":604800}
location
/cdn-cgi/challenge-platform/h/g/scripts/jsd/dc6b543c1346/main.js
access-control-allow-origin
*
cache-control
max-age=300, public
cf-ray
86e1930b7f2aa96d-SYD
alt-svc
h3=":443"; ma=86400
content-length
0
favicon.ico
portal-foractiviy.ru/
548 B
642 B
Other
General
Full URL
https://portal-foractiviy.ru/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.128.128 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
25fb23868ebf48348f9e438e00cb9b9d9b3a054f32482a781c762cc4f9cc6393
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block, 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://portal-foractiviy.ru/fidi
accept-language
en-AU,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
public
date
Tue, 02 Apr 2024 14:40:30 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
169875
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BwPTwPwSlm8%2BkBZDKAsKFtKaqtXzhvtNYbVWIz%2FdEf988DBmgevKAMF4TmVPTBUOn%2FlF2Ep5rLL14YVL2F0XpxwSD%2F6H638ZnVsQ9KiCVkiDRJaxu7DjumVB76dFWBsDq8fM32NnVg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cache-control
public, max-age=315360000, stale-while-revalidate=315360000, stale-if-error=315360000, immutable
cf-ray
86e1930b7f2ba96d-SYD
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block, 1; mode=block
86e193077d96a96d
portal-foractiviy.ru/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame 5A72
0
600 B
XHR
General
Full URL
https://portal-foractiviy.ru/cdn-cgi/challenge-platform/h/g/jsd/r/86e193077d96a96d
Requested by
Host: portal-foractiviy.ru
URL: https://portal-foractiviy.ru/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.128.128 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform
"Win32"
Referer
accept-language
en-AU,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type
application/json

Response headers

date
Tue, 02 Apr 2024 14:40:30 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nQ0h%2Bj%2BtLjq4F8iwuB4b5wwAefnwuLzU3c0SoNuiX0gutQU7x5sfyeREdAI%2BuwH4b4Qh8OCYo3Fp1%2Ft%2BhVkcXGouEwugguhC1XJIQktpaBQnoAFso91b%2BL2kUPbvzOUh2HS2pVKjOQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/plain; charset=UTF-8
cf-ray
86e1930c1f65a96d-SYD
alt-svc
h3=":443"; ma=86400
Primary Request fidi
portal-foractiviy.ru/
257 B
583 B
Document
General
Full URL
https://portal-foractiviy.ru/fidi
Requested by
Host: portal-foractiviy.ru
URL: https://portal-foractiviy.ru/fidi
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.128.128 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e5128b5e331cad19df2f67041ffc85bf716d6e6106dea098c37524593fb268e9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block 1; mode=block

Request headers

Referer
https://portal-foractiviy.ru/fidi
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language
en-AU,en;q=0.9
sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
86e1930d5fe5a96d-SYD
content-encoding
br
content-type
text/html
date
Tue, 02 Apr 2024 14:40:30 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z7%2FAvLYS3DGH1kTLvJo2MYmeCx5KQd8psQnyaJuJPfDjngNFM096HBXR28m1Bz040Z8aTYoqgJj2qT7%2Bthbk8k23Q2THsdN4Q%2BiuVJCpqEV0gXi5PlijyVvOSZl9m7AHPsn%2BCfO6lQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
1; mode=block 1; mode=block
favicon.ico
portal-foractiviy.ru/
548 B
647 B
Other
General
Full URL
https://portal-foractiviy.ru/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.128.128 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
25fb23868ebf48348f9e438e00cb9b9d9b3a054f32482a781c762cc4f9cc6393
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block, 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://portal-foractiviy.ru/fidi
accept-language
en-AU,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
public
date
Tue, 02 Apr 2024 14:40:30 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
169875
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QDl2z0%2BpD1cdP3dud%2BYpqgcp7vN%2BYldZIC9s11dRQcki7DPKSEbyfvKreJ5OW2%2BiubKDnPK%2FM6XHm51CYt2qKPXWjUWmW8kO%2Bs%2B2xm10tQvfmsI8M85%2FTUGim%2FqKgblXxOu9JOoYvw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cache-control
public, max-age=315360000, stale-while-revalidate=315360000, stale-if-error=315360000, immutable
cf-ray
86e19310b97fa96d-SYD
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block, 1; mode=block

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onpagereveal

9 Cookies

Domain/Path Name / Value
portal-foractiviy.ru/ Name: QQko7PWpyHd4DHVV8SJMzYNkuqw
Value: DgbTDkEAR0q-FGVkQCpaGDnpLcA
portal-foractiviy.ru/ Name: n_iiMRHol_wWoPoQ4epBs3j62G4
Value: 1712068800
portal-foractiviy.ru/ Name: JlHrPpZ2OhuC9URS1v-wpFJZbdA
Value: 1712155200
portal-foractiviy.ru/ Name: GzfCjqEUS7b8NdMb19XnuZwIiaY
Value: ZeOAt_i6S3Ufd3wT5paYyPsTqH8
portal-foractiviy.ru/ Name: ig4AAvmtqCerUYSzbr1CFJOGtGU
Value: UiM08yhOj24R6VwVvfLvEaHeVn0
.portal-foractiviy.ru/ Name: cf_clearance
Value: SAJMtSOmSz5JmCnYXgxNpCPoGBsd4E04xI8ZD0LygtA-1712068830-1.0.1.1-zscGxmDwA8M01y0.imtddcxQ3IJs7Wgz4mRdUAB.SyMJapXm6o_s0jDahygSh9LxSn14tLpPlC3L05pTDIB64A
portal-foractiviy.ru/ Name: Nq1Car6JjdN3RHaavG9XgQKUlt4
Value: 1712068828
portal-foractiviy.ru/ Name: B8Puz-qAqjkm5I1MSlty_s1BrPA
Value: 1712155228
portal-foractiviy.ru/ Name: JwFc1D6Rtq6zpTyQvNl4TQcWxcc
Value: V-JBzXjGK86tNiI9RqC79GC2TbE

4 Console Messages

Source Level URL
Text
network error URL: https://portal-foractiviy.ru/fidi
Message:
Failed to load resource: the server responded with a status of 503 ()
network error URL: https://portal-foractiviy.ru/favicon.ico
Message:
Failed to load resource: the server responded with a status of 403 ()
network error URL: https://portal-foractiviy.ru/fidi
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://portal-foractiviy.ru/favicon.ico
Message:
Failed to load resource: the server responded with a status of 403 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block 1; mode=block