sprinkler.lookabot.net Open in urlscan Pro
116.212.224.188 Public Scan

Go To Rescan
Add Verdict Report

URL:
http://sprinkler.lookabot.net/host15/admin/js/mj.php
Submission: On July 10 via api (July 10th 2023, 3:05:29 pm UTC) from IN — Scanned from AU

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 5 domains to perform 8 HTTP transactions. The main IP is 116.212.224.188, located in Perth, Australia and belongs to VOCUS-BACKBONE-AS Vocus Connect International Backbone, AU. The main domain is sprinkler.lookabot.net.

This is the only time sprinkler.lookabot.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	116.212.224.188 116.212.224.188	4826 (VOCUS-BAC...) (VOCUS-BACKBONE-AS Vocus Connect International Backbone)
1	104.26.3.242 104.26.3.242	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	190.115.26.9 190.115.26.9	262254 (DDOS-GUAR...) (DDOS-GUARD CORP.)
1	104.22.32.65 104.22.32.65	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	5

1 116.212.224.188 (Perth, Australia)

ASN4826 (VOCUS-BACKBONE-AS Vocus Connect International Backbone, AU)
PTR: 116-212-224-188.mxhosting.com.au

sprinkler.lookabot.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.26.3.242 (None, )

ASN13335 (CLOUDFLARENET, US)

ghantalele.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 190.115.26.9 (Belize City, Belize)

ASN262254 (DDOS-GUARD CORP., BZ)

bitly.help	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.22.32.65 (None, )

ASN13335 (CLOUDFLARENET, US)

wallpaperaccess.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	bitly.help bitly.help	7 KB
1	wallpaperaccess.com wallpaperaccess.com — Cisco Umbrella Rank: 88754	39 KB
1	ghantalele.com ghantalele.com	608 B
1	lookabot.net sprinkler.lookabot.net	632 B
0	domaintestss.xyz Failed domaintestss.xyz Failed
8	5

	Domain	Requested by
4	bitly.help	sprinkler.lookabot.net
1	wallpaperaccess.com	sprinkler.lookabot.net
1	ghantalele.com	sprinkler.lookabot.net
1	sprinkler.lookabot.net
0	domaintestss.xyz Failed	ghantalele.com
8	5

This site contains no links.

Subject Issuer	Validity	Valid
ghantalele.com GTS CA 1P5	`2023-06-08` - `2023-09-06`	3 months	crt.sh
bitly.help R3	`2023-07-06` - `2023-10-04`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-04-29` - `2024-04-28`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://sprinkler.lookabot.net/host15/admin/js/mj.php
Frame ID: 90C8DD568FA6F04A4B9A9BDFAA659148
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

COMING SOON

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

8
Requests

75 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

47 kB
Transfer

45 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request mj.php Show response
sprinkler.lookabot.net/host15/admin/js/ 424 B
632 B 1420ms
551ms Document
text/html 116.212.224.188
VOCUS-BACKBONE-AS...

General

Check archive.org

Show headers Download Go to

Full URL: http://sprinkler.lookabot.net/host15/admin/js/mj.php
Protocol: HTTP/1.1
Server: 116.212.224.188 Perth, Australia, ASN4826 (VOCUS-BACKBONE-AS Vocus Connect International Backbone, AU),
Reverse DNS: 116-212-224-188.mxhosting.com.au
Software: Apache /
Resource Hash: 2c49ad8466ae7ee0d04a898c065b62dc0ab41e9a1158e95ad303297ab584b40f

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Mon, 10 Jul 2023 15:05:21 GMT
Keep-Alive: timeout=5, max=100
Server: Apache
Transfer-Encoding: chunked

GET
H2 200 cgi-bin.js Show response
ghantalele.com/ 143 B
608 B 1491ms
930ms Script
application/javascript 104.26.3.242
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ghantalele.com/cgi-bin.js
Requested by: Host: sprinkler.lookabot.net
URL: http://sprinkler.lookabot.net/host15/admin/js/mj.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.3.242 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7f6ebba113fcc91fc6dc22f85379dc591a522225b52cb9bf409555486a6e792e

Request headers

accept-language: en-AU,en;q=0.9
Referer: http://sprinkler.lookabot.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 10 Jul 2023 15:05:22 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Sat, 01 Jul 2023 17:54:09 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9jPkiri67LSePHuDCnwureKxEjn%2BljaAjrpTw5SfS%2FrJ7HzSpYvY2V2ow2yFg0tPVAZQvcy9f1NcAwJTSZ%2Fk%2FaS6kQ5WW8M9JqqokA2rtPeILljl8Mz%2BP5gN6sRnmsE5"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=3600
cf-ray: 7e49b4595afca831-SYD
expires: Mon, 10 Jul 2023 16:05:22 GMT

GET
H2 200 kZn1j1.js Show response
bitly.help/ 2 KB
2 KB 2248ms
926ms Script
text/javascript 190.115.26.9
DDOS-GUARD CORP.

General

Check archive.org

Show headers Download Go to

Full URL

https://bitly.help/kZn1j1.js

Requested by

Host: sprinkler.lookabot.net
URL: http://sprinkler.lookabot.net/host15/admin/js/mj.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

190.115.26.9 Belize City, Belize, ASN262254 (DDOS-GUARD CORP., BZ),

Reverse DNS

Software

ddos-guard /

Resource Hash

bfcdc9f57883a167fe1a324c3db39b3c9bbc4fdc8a430125398aa52d6edbccc0

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;

Request headers

accept-language: en-AU,en;q=0.9
Referer: http://sprinkler.lookabot.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

expires: 0
pragma: no-cache
content-security-policy: upgrade-insecure-requests;
date: Mon, 10 Jul 2023 15:05:23 GMT
cache-control: no-cache, no-store, must-revalidate
server: ddos-guard
content-type: text/javascript;charset=UTF-8

GET wds.min.php
domaintestss.xyz/cdn-js/ 0
0

GET
H2 200 wordpress-2528174
wallpaperaccess.com/download/ 39 KB
39 KB 1160ms
638ms Image
application/octet-stream 104.22.32.65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://wallpaperaccess.com/download/wordpress-2528174

Requested by

Host: sprinkler.lookabot.net
URL: http://sprinkler.lookabot.net/host15/admin/js/mj.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.22.32.65 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

955d353e6d4f360e4fec51ee123d73c9aa23a7dbb0bacd6693a2e8a551046798

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-AU,en;q=0.9
Referer: http://sprinkler.lookabot.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 10 Jul 2023 15:05:24 GMT
cf-cache-status: DYNAMIC
server: cloudflare
x-frame-options: SAMEORIGIN
content-type: application/octet-stream
content-transfer-encoding: Binary
content-disposition: attachment; filename="2528174.png"
x-robots-tag: noindex
cf-ray: 7e49b4673f3caabb-SYD
alt-svc: h3=":443"; ma=86400

GET
H2 200 kZn1j1.js Show response
bitly.help/ 2 KB
2 KB 417ms
417ms Script
text/javascript 190.115.26.9
DDOS-GUARD CORP.

General

Check archive.org

Show headers Download Go to

Full URL

https://bitly.help/kZn1j1.js

Requested by

Host: sprinkler.lookabot.net
URL: http://sprinkler.lookabot.net/host15/admin/js/mj.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

190.115.26.9 Belize City, Belize, ASN262254 (DDOS-GUARD CORP., BZ),

Reverse DNS

Software

ddos-guard /

Resource Hash

bfcdc9f57883a167fe1a324c3db39b3c9bbc4fdc8a430125398aa52d6edbccc0

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;

Request headers

accept-language: en-AU,en;q=0.9
Referer: http://sprinkler.lookabot.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

expires: 0
pragma: no-cache
content-security-policy: upgrade-insecure-requests;
date: Mon, 10 Jul 2023 15:05:23 GMT
cache-control: no-cache, no-store, must-revalidate
server: ddos-guard
content-type: text/javascript;charset=UTF-8

GET
H2 200 kZn1j1.js Show response
bitly.help/ 2 KB
2 KB 400ms
400ms Script
text/javascript 190.115.26.9
DDOS-GUARD CORP.

General

Check archive.org

Show headers Download Go to

Full URL

https://bitly.help/kZn1j1.js

Requested by

Host: sprinkler.lookabot.net
URL: http://sprinkler.lookabot.net/host15/admin/js/mj.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

190.115.26.9 Belize City, Belize, ASN262254 (DDOS-GUARD CORP., BZ),

Reverse DNS

Software

ddos-guard /

Resource Hash

e65933854e864a2368454087cba95602fc89b65683c2cbaa11a85544314b3c27

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;

Request headers

accept-language: en-AU,en;q=0.9
Referer: http://sprinkler.lookabot.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

expires: 0
pragma: no-cache
content-security-policy: upgrade-insecure-requests;
date: Mon, 10 Jul 2023 15:05:24 GMT
cache-control: no-cache, no-store, must-revalidate
server: ddos-guard
content-type: text/javascript;charset=UTF-8

GET
H2 200 kZn1j1.js Show response
bitly.help/ 2 KB
2 KB 400ms
400ms Script
text/javascript 190.115.26.9
DDOS-GUARD CORP.

General

Check archive.org

Show headers Download Go to

Full URL

https://bitly.help/kZn1j1.js

Requested by

Host: sprinkler.lookabot.net
URL: http://sprinkler.lookabot.net/host15/admin/js/mj.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

190.115.26.9 Belize City, Belize, ASN262254 (DDOS-GUARD CORP., BZ),

Reverse DNS

Software

ddos-guard /

Resource Hash

e65933854e864a2368454087cba95602fc89b65683c2cbaa11a85544314b3c27

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;

Request headers

accept-language: en-AU,en;q=0.9
Referer: http://sprinkler.lookabot.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

expires: 0
pragma: no-cache
content-security-policy: upgrade-insecure-requests;
date: Mon, 10 Jul 2023 15:05:24 GMT
cache-control: no-cache, no-store, must-revalidate
server: ddos-guard
content-type: text/javascript;charset=UTF-8

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: domaintestss.xyz
URL: https://domaintestss.xyz/cdn-js/wds.min.php

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://domaintestss.xyz/cdn-js/wds.min.php Message: Failed to load resource: net::ERR_CONNECTION_REFUSED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bitly.help
domaintestss.xyz
ghantalele.com
sprinkler.lookabot.net
wallpaperaccess.com
domaintestss.xyz
104.22.32.65
104.26.3.242
116.212.224.188
190.115.26.9
2c49ad8466ae7ee0d04a898c065b62dc0ab41e9a1158e95ad303297ab584b40f
7f6ebba113fcc91fc6dc22f85379dc591a522225b52cb9bf409555486a6e792e
955d353e6d4f360e4fec51ee123d73c9aa23a7dbb0bacd6693a2e8a551046798
bfcdc9f57883a167fe1a324c3db39b3c9bbc4fdc8a430125398aa52d6edbccc0
e65933854e864a2368454087cba95602fc89b65683c2cbaa11a85544314b3c27

sprinkler.lookabot.net Open in urlscan Pro 116.212.224.188 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

8 Requests

75 %HTTPS

0 %IPv6

5 Domains

5 Subdomains

5 IPs

3 Countries

47 kBTransfer

45 kBSize

0 Cookies

0 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

sprinkler.lookabot.net Open in urlscan Pro
116.212.224.188 Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

75 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

47 kB
Transfer

45 kB
Size

0
Cookies

8 HTTP transactions
0 data transactions