Submitted URL: https://kvwumgb.korecenac.co.ua/
Effective URL: https://buthawk.com/g0tqn0nf?key=33f1f4b19ef86d44444ef4ab2d77e822
Submission: On March 10 via api from US — Scanned from US

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 4 HTTP transactions. The main IP is 192.243.61.225, located in Ashburn, United States and belongs to ADVANCEDHOSTERS-AS, NL. The main domain is buthawk.com.
TLS certificate: Issued by R3 on February 16th 2024. Valid for: 3 months.
This is the only time buthawk.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2606:4700:303... 13335 (CLOUDFLAR...)
1 149.56.240.27 16276 (OVH)
1 2620:1ec:c11:... 8068 (MICROSOFT...)
1 192.243.61.225 39572 (ADVANCEDH...)
4 4
Apex Domain
Subdomains
Transfer
1 buthawk.com
buthawk.com
817 B
1 bing.net
ts2.mm.bing.net — Cisco Umbrella Rank: 150851
19 KB
1 histats.com
sstatic1.histats.com — Cisco Umbrella Rank: 50494
163 B
1 co.ua
kvwumgb.korecenac.co.ua
10 KB
4 4
Domain Requested by
1 buthawk.com kvwumgb.korecenac.co.ua
1 ts2.mm.bing.net kvwumgb.korecenac.co.ua
1 sstatic1.histats.com kvwumgb.korecenac.co.ua
1 kvwumgb.korecenac.co.ua
4 4

This site contains links to these domains. Also see Links.

Domain
highperformancedformats.com
Subject Issuer Validity Valid
korecenac.co.ua
GTS CA 1P5
2024-02-21 -
2024-05-21
3 months crt.sh
histats.com
R3
2024-02-16 -
2024-05-16
3 months crt.sh
www.bing.com
Microsoft Azure TLS Issuing CA 02
2024-01-21 -
2024-06-27
5 months crt.sh
buthawk.com
R3
2024-02-16 -
2024-05-16
3 months crt.sh

This page contains 1 frames:

Primary Page: https://buthawk.com/g0tqn0nf?key=33f1f4b19ef86d44444ef4ab2d77e822
Frame ID: 553AE7AC87FD2CFFE70A809295BA011E
Requests: 4 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://kvwumgb.korecenac.co.ua/ Page URL
  2. https://buthawk.com/g0tqn0nf?key=33f1f4b19ef86d44444ef4ab2d77e822 Page URL

Page Statistics

4
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

30 kB
Transfer

46 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://kvwumgb.korecenac.co.ua/ Page URL
  2. https://buthawk.com/g0tqn0nf?key=33f1f4b19ef86d44444ef4ab2d77e822 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
kvwumgb.korecenac.co.ua/
27 KB
10 KB
Document
General
Full URL
https://kvwumgb.korecenac.co.ua/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::6815:3aa2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b5d1e6650eb3f4d535be67f96d87c0bf10f9b622e9dea155da18386a979daf70

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
86242dbaef09c439-EWR
content-encoding
br
content-type
text/html; charset=UTF-8
date
Sun, 10 Mar 2024 15:01:11 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cOqa4CvApK5ZMLrneBrduNeO9uV90GhAQXGBNHxfQ6ZhmdTH0JWq9PvjATgttU30yUIJJVy3aloCBzfsbsVAX0gP1H2WwYr7j8XIlxKs%2BdsO6BIF4O8HdOyuXe4BlrUNcKDudjQgW0YoMeovpFpYXXcyiSx%2BoQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding,User-Agent
0.gif
sstatic1.histats.com/
43 B
163 B
Image
General
Full URL
https://sstatic1.histats.com/0.gif?4846281&101
Requested by
Host: kvwumgb.korecenac.co.ua
URL: https://kvwumgb.korecenac.co.ua/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
149.56.240.27 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
ns534106.ip-149-56-240.net
Software
/
Resource Hash

Request headers

accept-language
en-US,en;q=0.9
Referer
https://kvwumgb.korecenac.co.ua/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

Date
Sun, 10 Mar 2024 15:01:11 GMT
Connection
close
Content-Length
43
Content-Type
image/gif
th
ts2.mm.bing.net/
19 KB
19 KB
Image
General
Full URL
https://ts2.mm.bing.net/th?q=2023%20Bad%20gateway%20Error%20code%20502%20footprint%20and%20-%20bentijoyu.info%20%3Cstrong%3Eawareness%20is
Requested by
Host: kvwumgb.korecenac.co.ua
URL: https://kvwumgb.korecenac.co.ua/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash

Request headers

accept-language
en-US,en;q=0.9
Referer
https://kvwumgb.korecenac.co.ua/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date
Sun, 10 Mar 2024 15:01:11 GMT
nel
{"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: ABB2CF421ECA47E8BDFC387E2ADC88DD Ref B: NYCEDGE1310 Ref C: 2024-03-10T15:01:11Z
access-control-allow-methods
GET, POST, OPTIONS
x-cache
TCP_HIT
access-control-allow-origin
*
report-to
{"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
content-type
image/jpeg
cache-control
public, max-age=5184000
timing-allow-origin
*
access-control-allow-headers
*
content-length
19267
Primary Request g0tqn0nf
buthawk.com/
115 B
817 B
Document
General
Full URL
https://buthawk.com/g0tqn0nf?key=33f1f4b19ef86d44444ef4ab2d77e822
Requested by
Host: kvwumgb.korecenac.co.ua
URL: https://kvwumgb.korecenac.co.ua/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.243.61.225 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.21.6 /
Resource Hash
f28ce5befe08ed90a2e12b6b2a5e9fdafaa6ad173503079155260aa480c66590
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubdomains

Request headers

Referer
https://kvwumgb.korecenac.co.ua/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

Accept-CH
Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Cache-Control
no-cache
Connection
keep-alive
Content-Length
115
Content-Type
text/html
Date
Sun, 10 Mar 2024 15:01:12 GMT
Expires
Thu, 01 Jan 1970 00:00:01 GMT
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Server
nginx/1.21.6
Strict-Transport-Security
max-age=0; includeSubdomains
X-Request-ID
8e384334eaf71ece7b3253ee319ac94d

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Domain/Path Name / Value
buthawk.com/ Name: u_pl
Value: 19229187

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

buthawk.com
kvwumgb.korecenac.co.ua
sstatic1.histats.com
ts2.mm.bing.net
149.56.240.27
192.243.61.225
2606:4700:3035::6815:3aa2
2620:1ec:c11::200
b5d1e6650eb3f4d535be67f96d87c0bf10f9b622e9dea155da18386a979daf70
f28ce5befe08ed90a2e12b6b2a5e9fdafaa6ad173503079155260aa480c66590