dl2.downbox.xyz - urlscan.io

Summary

This website contacted 5 IPs in 3 countries across 4 domains to perform 6 HTTP transactions. The main IP is 94.182.110.170, located in Iran, Islamic Republic Of and belongs to RASANA, IR. The main domain is dl2.downbox.xyz.

This is the only time dl2.downbox.xyz was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	94.182.110.170 94.182.110.170	31549 (RASANA) (RASANA)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:3a	20446 (HIGHWINDS3) (HIGHWINDS3)
2	151.139.237.11 151.139.237.11	33438 (HIGHWINDS2) (HIGHWINDS2)
1	178.216.249.18 178.216.249.18	43754 (ASIATECH) (ASIATECH)
1	178.216.249.130 178.216.249.130	43754 (ASIATECH) (ASIATECH)
6	5

1 94.182.110.170 (Iran, Islamic Republic Of)

ASN31549 (RASANA, IR)
PTR: 94-182-110-170.shatel.ir

dl2.downbox.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:3a (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.139.237.11 (Dallas, United States)

ASN33438 (HIGHWINDS2, US)

cdn.rawgit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.216.249.18 (Iran, Islamic Republic Of)

ASN43754 (ASIATECH, IR)

parsaspace.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.216.249.130 (Iran, Islamic Republic Of)

ASN43754 (ASIATECH, IR)

defaultpage.parsaspace.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	parsaspace.com parsaspace.com defaultpage.parsaspace.com	135 KB
2	rawgit.com cdn.rawgit.com	39 KB
1	jquery.com code.jquery.com	30 KB
1	downbox.xyz dl2.downbox.xyz	5 KB
6	4

	Domain	Requested by
2	cdn.rawgit.com	dl2.downbox.xyz
1	defaultpage.parsaspace.com	dl2.downbox.xyz
1	parsaspace.com	dl2.downbox.xyz
1	code.jquery.com	dl2.downbox.xyz
1	dl2.downbox.xyz
6	5

This site contains no links.

Subject Issuer	Validity	Valid
jquery.org COMODO RSA Domain Validation Secure Server CA	`2018-10-17` - `2020-10-16`	2 years	crt.sh
rawgit.com Sectigo RSA Domain Validation Secure Server CA	`2020-01-03` - `2022-01-12`	2 years	crt.sh
parsaspace.com Let's Encrypt Authority X3	`2020-03-02` - `2020-05-31`	3 months	crt.sh
defaultpage.parsaspace.com Let's Encrypt Authority X3	`2020-01-18` - `2020-04-17`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://dl2.downbox.xyz/
Frame ID: BF766FA4CDE8B77802F7261F30C26B00
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Ubuntu (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Ubuntu/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

6
Requests

83 %
HTTPS

20 %
IPv6

4
Domains

5
Subdomains

5
IPs

3
Countries

209 kB
Transfer

263 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 403
Forbidden Primary Request / Show response
dl2.downbox.xyz/ 5 KB
5 KB 1255ms
1221ms Document
text/html 94.182.110.170
RASANA

General

Check archive.org

Show headers Download Go to

Full URL: http://dl2.downbox.xyz/
Protocol: HTTP/1.1
Server: 94.182.110.170 , Iran, Islamic Republic Of, ASN31549 (RASANA, IR),
Reverse DNS: 94-182-110-170.shatel.ir
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: 845f863bd0d729d9960afcf629467eb8563793265b8e894572df1c5ea1f5780e

Request headers

Host: dl2.downbox.xyz
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Server: nginx/1.10.3 (Ubuntu)
Date: Tue, 10 Mar 2020 21:45:56 GMT
Content-Type: text/html
Content-Length: 4802
Connection: keep-alive
ETag: "5de4c0da-12c2"

GET
H/1.1 200
OK jquery-3.3.1.min.js Show response
code.jquery.com/ 85 KB
30 KB 20ms
7ms Script
application/javascript 2001:4de0:ac19::1:b:3a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.3.1.min.js
Requested by: Host: dl2.downbox.xyz
URL: http://dl2.downbox.xyz/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:4de0:ac19::1:b:3a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Request headers

Referer: http://dl2.downbox.xyz/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Tue, 10 Mar 2020 21:45:56 GMT
Content-Encoding: gzip
Last-Modified: Sat, 20 Jan 2018 17:26:44 GMT
Server: nginx
ETag: W/"5a637bd4-1538f"
Vary: Accept-Encoding
X-HW: 1583876756.dop021.fr8.shc,1583876756.dop021.fr8.t,1583876756.cds057.fr8.c
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=315360000, public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 30288

GET
H2 200 font-face.css
cdn.rawgit.com/rastikerdar/vazir-font/v19.2.0/dist/ 2 KB
984 B 53ms
16ms Stylesheet
text/css 151.139.237.11
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.rawgit.com/rastikerdar/vazir-font/v19.2.0/dist/font-face.css

Requested by

Host: dl2.downbox.xyz
URL: http://dl2.downbox.xyz/

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.139.237.11 Dallas, United States, ASN33438 (HIGHWINDS2, US),

Reverse DNS

Software

NetDNA-cache/2.2 /

Resource Hash

08353c3fb30dca059ee44728bd9e4cde4e7d49c846246cb089d8ad2d91606805

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload, max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://dl2.downbox.xyz/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Tue, 10 Mar 2020 21:45:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
x-cache: HIT
status: 200
strict-transport-security: max-age=31536000; preload, max-age=31536000; preload
sunset: Tue, 01 Oct 2019 00:00:00 GMT
rawgit-cache-status: HIT
x-robots-tag: none
server: NetDNA-cache/2.2
etag: W/"3a62246d2fa07b62838d75a1781ffa6b9a8f1df4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css;charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315569000, immutable
cf-ray: 4adfce7f2c4d9d3e-AMS
link: <https://rawgit.com/>; rel="sunset"; title="RawGit will soon shut down. Please stop using it."

GET
H/1.1 200
OK logo-parsa-130-69-2.png
parsaspace.com/Content/Web/assets/images/logo/ 13 KB
13 KB 825ms
267ms Image
image/png 178.216.249.18
ASIATECH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://parsaspace.com/Content/Web/assets/images/logo/logo-parsa-130-69-2.png
Requested by: Host: dl2.downbox.xyz
URL: http://dl2.downbox.xyz/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 178.216.249.18 , Iran, Islamic Republic Of, ASN43754 (ASIATECH, IR),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 1f105dab5185920619b1fc724d3b632a7011908ddbeb44bc3ad4c6618a0501b6

Request headers

Referer: http://dl2.downbox.xyz/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Tue, 10 Mar 2020 21:45:57 GMT
ETag: "a469cd8e21add21:0"
Last-Modified: Tue, 04 Apr 2017 08:57:58 GMT
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Content-Type: image/png
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 12875

GET
H/1.1 200
OK parsaBackground-min.jpg
defaultpage.parsaspace.com/ 122 KB
122 KB 831ms
425ms Image
image/jpeg 178.216.249.130
ASIATECH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://defaultpage.parsaspace.com/parsaBackground-min.jpg
Requested by: Host: dl2.downbox.xyz
URL: http://dl2.downbox.xyz/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 178.216.249.130 , Iran, Islamic Republic Of, ASN43754 (ASIATECH, IR),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: 9ad7ab78f5e2fd7885ae7c8db281149108defb5c7e7169166f7c918d37ddbe4c

Request headers

Referer: http://dl2.downbox.xyz/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Tue, 10 Mar 2020 21:45:57 GMT
Last-Modified: Wed, 14 Nov 2018 08:03:31 GMT
Server: nginx/1.10.3 (Ubuntu)
ETag: "5bebd6d3-1e8db"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 125147

GET
H2 200 Vazir.woff2
cdn.rawgit.com/rastikerdar/vazir-font/v19.2.0/dist/ 37 KB
38 KB 61ms
28ms Font
font/woff2 151.139.237.11
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.rawgit.com/rastikerdar/vazir-font/v19.2.0/dist/Vazir.woff2

Requested by

Host: dl2.downbox.xyz
URL: http://dl2.downbox.xyz/

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.139.237.11 Dallas, United States, ASN33438 (HIGHWINDS2, US),

Reverse DNS

Software

NetDNA-cache/2.2 /

Resource Hash

c8117ac9ba09e320c0a3e33c2c19a3b52971df337dacb2ae18ee2fb61007b722

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload, max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cdn.rawgit.com/rastikerdar/vazir-font/v19.2.0/dist/font-face.css
Origin: http://dl2.downbox.xyz
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 10 Mar 2020 21:45:56 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
x-cache: HIT
status: 200
strict-transport-security: max-age=31536000; preload, max-age=31536000; preload
sunset: Tue, 01 Oct 2019 00:00:00 GMT
rawgit-cache-status: HIT
x-robots-tag: none
server: NetDNA-cache/2.2
etag: W/"794c6d8b24702f40158d4880be5eabef120db4b1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=315569000, immutable
cf-ray: 4adfce822eff9ca1-AMS
link: <https://rawgit.com/>; rel="sunset"; title="RawGit will soon shut down. Please stop using it."

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.rawgit.com
code.jquery.com
defaultpage.parsaspace.com
dl2.downbox.xyz
parsaspace.com
151.139.237.11
178.216.249.130
178.216.249.18
2001:4de0:ac19::1:b:3a
94.182.110.170
08353c3fb30dca059ee44728bd9e4cde4e7d49c846246cb089d8ad2d91606805
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
1f105dab5185920619b1fc724d3b632a7011908ddbeb44bc3ad4c6618a0501b6
845f863bd0d729d9960afcf629467eb8563793265b8e894572df1c5ea1f5780e
9ad7ab78f5e2fd7885ae7c8db281149108defb5c7e7169166f7c918d37ddbe4c
c8117ac9ba09e320c0a3e33c2c19a3b52971df337dacb2ae18ee2fb61007b722

dl2.downbox.xyz Open in urlscan Pro 94.182.110.170 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

6 Requests

83 %HTTPS

20 %IPv6

4 Domains

5 Subdomains

5 IPs

3 Countries

209 kBTransfer

263 kBSize

0 Cookies

0 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

0 Cookies

Indicators

dl2.downbox.xyz Open in urlscan Pro
94.182.110.170 Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

83 %
HTTPS

20 %
IPv6

4
Domains

5
Subdomains

5
IPs

3
Countries

209 kB
Transfer

263 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions