Submitted URL: https://admin.post.mosgortur.ru/
Effective URL: https://admin.post.mosgortur.ru/login
Submission: On March 20 via automatic, source certstream-suspicious — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 3 HTTP transactions. The main IP is 81.23.1.212, located in Lyubertsy, Russian Federation and belongs to GARS-AS Moscow, Russia, RU. The main domain is admin.post.mosgortur.ru.
TLS certificate: Issued by R3 on March 20th 2022. Valid for: 3 months.
This is the only time admin.post.mosgortur.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 4 81.23.1.212 31261 (GARS-AS M...)
3 1
Apex Domain
Subdomains
Transfer
4 mosgortur.ru
admin.post.mosgortur.ru
142 KB
3 1
Domain Requested by
4 admin.post.mosgortur.ru 1 redirects admin.post.mosgortur.ru
3 1

This site contains no links.

Subject Issuer Validity Valid
admin.post.mosgortur.ru
R3
2022-03-20 -
2022-06-18
3 months crt.sh

This page contains 1 frames:

Primary Page: https://admin.post.mosgortur.ru/login
Frame ID: 261C2ADC56D6D2E09AE309DBF2121153
Requests: 3 HTTP requests in this frame

Screenshot

Page Title

Миграция почтового ящика ГАУК "МОСГОРТУР"

Page URL History Show full URLs

  1. https://admin.post.mosgortur.ru/ HTTP 302
    https://admin.post.mosgortur.ru/login Page URL

Detected technologies

Overall confidence: 100%
Detected patterns

Page Statistics

3
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

141 kB
Transfer

813 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://admin.post.mosgortur.ru/ HTTP 302
    https://admin.post.mosgortur.ru/login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request login
admin.post.mosgortur.ru/
Redirect Chain
  • https://admin.post.mosgortur.ru/
  • https://admin.post.mosgortur.ru/login
2 KB
2 KB
Document
General
Full URL
https://admin.post.mosgortur.ru/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
81.23.1.212 Lyubertsy, Russian Federation, ASN31261 (GARS-AS Moscow, Russia, RU),
Reverse DNS
mail.jjj.ru
Software
nginx /
Resource Hash
2a481bc6c976f1b29d0c79ddf44a3322798c9709662d50da4fb4fd9970b81a2d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

server
nginx
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
cache-control
no-cache, private
date
Sun, 20 Mar 2022 04:54:26 GMT
x-frame-options
SAMEORIGIN
x-content-type-options
nosniff
content-encoding
gzip

Redirect headers

server
nginx
content-type
text/html; charset=UTF-8
location
https://admin.post.mosgortur.ru/login
cache-control
no-cache, private
date
Sun, 20 Mar 2022 04:54:26 GMT
x-frame-options
SAMEORIGIN
x-content-type-options
nosniff
app.css
admin.post.mosgortur.ru/css/
203 KB
26 KB
Stylesheet
General
Full URL
https://admin.post.mosgortur.ru/css/app.css
Requested by
Host: admin.post.mosgortur.ru
URL: https://admin.post.mosgortur.ru/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
81.23.1.212 Lyubertsy, Russian Federation, ASN31261 (GARS-AS Moscow, Russia, RU),
Reverse DNS
mail.jjj.ru
Software
nginx /
Resource Hash
36fda10f070bdefc0d6b2f03f76835a61fbe469acb223801d3ff27980196e3d6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://admin.post.mosgortur.ru/login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sun, 20 Mar 2022 04:54:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 18 Mar 2022 21:45:33 GMT
server
nginx
etag
W/"6234fd7d-32ac4"
x-frame-options
SAMEORIGIN
content-type
text/css
cache-control
max-age=86400
vary
Accept-Encoding
expires
Mon, 21 Mar 2022 04:54:26 GMT
app.js
admin.post.mosgortur.ru/js/
608 KB
113 KB
Script
General
Full URL
https://admin.post.mosgortur.ru/js/app.js
Requested by
Host: admin.post.mosgortur.ru
URL: https://admin.post.mosgortur.ru/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
81.23.1.212 Lyubertsy, Russian Federation, ASN31261 (GARS-AS Moscow, Russia, RU),
Reverse DNS
mail.jjj.ru
Software
nginx /
Resource Hash
7b0d9e19a1203c1c0ab6201ad826b4b9bfd3f49834b548c849d222e87b8f92bd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://admin.post.mosgortur.ru/login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sun, 20 Mar 2022 04:54:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 18 Mar 2022 21:45:33 GMT
server
nginx
etag
W/"6234fd7d-9809f"
x-frame-options
SAMEORIGIN
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored object| webpackChunk function| _ function| axios

2 Cookies

Domain/Path Name / Value
admin.post.mosgortur.ru/ Name: XSRF-TOKEN
Value: eyJpdiI6IkI3NkdtcW94L1pUY1NIRnpxS0lXdUE9PSIsInZhbHVlIjoiUkFzckNZUzJHTUJBNHVtZWFEVnBSd2hBK3RWazZ4aE1CMFJvL3pMdjM3ZlFaQnFRL1p3MTJ3c3h2NE04MEV6dS9jN3lRNE96MjVYRnc4R2w2cW5mRGlhaTVTaklTaEZIczVmYmFVT3psY2M1L1BCb3FHN25VU3VxelpkcmJIUE4iLCJtYWMiOiI3OGJiNjFjYzJlMGE0NjQyZjIxZTgzNWI2NTA4ZjQ4M2I3YTVmNGM3NGI4ZjMzNTdkMWY4ODMwMTQ5MTM5OTAyIiwidGFnIjoiIn0%3D
admin.post.mosgortur.ru/ Name: laravel_session
Value: eyJpdiI6ImVqRms1OVVITUVyaWY1RGh4YzJMdVE9PSIsInZhbHVlIjoiREJVbVpOUEo0QVE3a2NvdGlPQndnRGpMMGdMZUVxNm02QmkzVThiYnFpR2QvZFFKZzVLWEQxMmltRWJuT1lIT09kVFRYVnZra3BGanFiMmgySm53YTJFbUtHK2JGS3NEby9PTmU4by9JeGE1U3RuYXhwaEYzSmJGWVd2TjFRcUUiLCJtYWMiOiJmYTk4MDI4N2RhYTBkNmYzYTcwODM4NmE4ODZjMjVjYTM1NjY4ZTZhYTUwYzAzMmM4OGNmMWIyZTE0MDYwMjgwIiwidGFnIjoiIn0%3D

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

admin.post.mosgortur.ru
81.23.1.212
2a481bc6c976f1b29d0c79ddf44a3322798c9709662d50da4fb4fd9970b81a2d
36fda10f070bdefc0d6b2f03f76835a61fbe469acb223801d3ff27980196e3d6
7b0d9e19a1203c1c0ab6201ad826b4b9bfd3f49834b548c849d222e87b8f92bd