URL: https://songlos.com/xRf0vWNOQsKb.php?pid=0552c379zwfhqfe9
Submission: On December 27 via manual from KR — Scanned from DE

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 21 HTTP transactions. The main IP is 2606:4700:3035::ac43:cb25, located in United States and belongs to CLOUDFLARENET, US. The main domain is songlos.com.
TLS certificate: Issued by R3 on December 14th 2021. Valid for: 3 months.
This is the only time songlos.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Downloads These files were downloaded by the website

MIME: RAR archive data, v5
Size: 8 MB (8718958 bytes, 100% done)
Downloaded from: https://www.supersong.nl/upload/59728.rar

Domain & IP information

IP Address AS Autonomous System
6 2606:4700:303... 13335 (CLOUDFLAR...)
1 185.37.71.70 48635 (PCEXTREME-)
21 3

This site contains no links.

Subject Issuer Validity Valid
*.songlos.com
R3
2021-12-14 -
2022-03-14
3 months crt.sh
supersong.nl
Sectigo RSA Domain Validation Secure Server CA
2021-12-09 -
2023-01-02
a year crt.sh

This page contains 1 frames:

Frame: https://www.supersong.nl/upload/59728.rar
Frame ID: B494373E6FFCF7EF8423C52A27B7BCDA
Requests: 21 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

21
Requests

33 %
HTTPS

50 %
IPv6

4
Domains

16
Subdomains

3
IPs

2
Countries

13 kB
Transfer

12 kB
Size

3
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request xRf0vWNOQsKb.php
songlos.com/
3 KB
2 KB
Document
General
Full URL
https://songlos.com/xRf0vWNOQsKb.php?pid=0552c379zwfhqfe9
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::ac43:cb25 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
278a18a358045b3838739d2ccce2e35a1472921a10fc1eb1ee94fa0429ab9d63

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

date
Mon, 27 Dec 2021 22:21:06 GMT
content-type
text/html;charset=UTF-8
vary
Accept-Encoding
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YSUl%2FjZDEmAJUPylRz5zOk5RxGRZdsywuB1jhBa9AGW1LbOn2WKhmx6tTw0ZQk%2B5boMqcXdAQ7CRFS%2FQN7ygUn7eH7iJO2tnN9cfQauO3PAZ5i5J31QguXHM68rBbM4b0vy4lXnWXq0OfQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
6c45f0a2cf84432d-FRA
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
now.js
songlos.com/
404 B
529 B
Script
General
Full URL
https://songlos.com/now.js?id=6640
Requested by
Host: songlos.com
URL: https://songlos.com/xRf0vWNOQsKb.php?pid=0552c379zwfhqfe9
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::ac43:cb25 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b296258e88842b62e722d4fd34b4642d5b23121368decec801ed98ed284d0de4

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://songlos.com/xRf0vWNOQsKb.php?pid=0552c379zwfhqfe9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Mon, 27 Dec 2021 22:21:06 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Tue, 03 Aug 2021 04:52:42 GMT
server
cloudflare
etag
W/"6108cb9a-194"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FfJ3SNb4fVMwmgRO%2FN9Tbo2VW%2B5Wd8reH3Lh%2FzAS33UMwtinnWiqODNsBQ3QdzSbDeC9KzywC0LcGtKXOTf%2FuKyXwkfXHwNndZMq77g46w0zCD7asJhVwoKeu6vgiRAJXA4niSMCwxaCsQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
max-age=315360000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
6c45f0a3a93e432d-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
expires
Thu, 31 Dec 2037 23:55:55 GMT
0041.png
songlos.com/
4 KB
5 KB
Image
General
Full URL
https://songlos.com/0041.png
Requested by
Host: songlos.com
URL: https://songlos.com/xRf0vWNOQsKb.php?pid=0552c379zwfhqfe9
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::ac43:cb25 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bf89e5fb2a02f3986cd32dc49fa987f9d50f4c55f2c787da7aff1644a5f7b8b0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://songlos.com/xRf0vWNOQsKb.php?pid=0552c379zwfhqfe9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Mon, 27 Dec 2021 22:21:06 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1340898
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
4488
last-modified
Sun, 12 Dec 2021 09:50:17 GMT
server
cloudflare
etag
"61b5c5d9-1188"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GnhOsIMSjNHyavgFBpBbkuN2frxiP27lVLeUgIPenBKkZeXqx843kKxn2ZCChtosdtTUUuQvaLOm%2FHXa4fzP4Wg%2Bg2kZj4DuGNYrpfHKn7cYufiTZML0wsRtiOnmQTdaIkaqQ4uUdFfr9A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=315360000
accept-ranges
bytes
cf-ray
6c45f0a3a944432d-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
img.php
songlos.com/
43 B
332 B
Image
General
Full URL
https://songlos.com/img.php?id=5&sub=398588e4n9h8&pid=0552c379zwfhqfe9
Requested by
Host: songlos.com
URL: https://songlos.com/xRf0vWNOQsKb.php?pid=0552c379zwfhqfe9
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::ac43:cb25 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://songlos.com/xRf0vWNOQsKb.php?pid=0552c379zwfhqfe9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Mon, 27 Dec 2021 22:21:06 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dAseAuaEOqThAR%2Bb%2BfCxDK67WuFzlRGvvlmIUyAsvN8a7C0zNAMEYvW86Nt27jiCOoar66dNmV2JQmb5ADThbwPTQ9LIxix3At1vapABz9QL8hLs%2BP0ndRp%2FVZQK1Gg31m%2F1R5tmfOevFA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cf-ray
6c45f0a3a948432d-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
43
59728.rar
www.supersong.nl/upload/
0
0
Document
General
Full URL
https://www.supersong.nl/upload/59728.rar
Requested by
Host: songlos.com
URL: https://songlos.com/xRf0vWNOQsKb.php?pid=0552c379zwfhqfe9
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.37.71.70 , Netherlands, ASN48635 (PCEXTREME-, NL),
Reverse DNS
server102.yourhosting.nl
Software
nginx / PleskLin
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://songlos.com/

Response headers

server
nginx
date
Mon, 27 Dec 2021 22:21:06 GMT
content-type
application/x-rar-compressed
content-length
8718958
last-modified
Sun, 26 Dec 2021 14:12:41 GMT
cache-control
max-age=2592000
expires
Wed, 26 Jan 2022 22:21:06 GMT
etag
"61c87859-850a6e"
x-powered-by
PleskLin
accept-ranges
bytes
img_new.php
songlos.com/
43 B
597 B
Image
General
Full URL
https://songlos.com/img_new.php?id=5&sub=398588e4n9h8&pid=0552c379zwfhqfe9&url=0.0.0.0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:cb25 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://songlos.com/xRf0vWNOQsKb.php?pid=0552c379zwfhqfe9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Mon, 27 Dec 2021 22:21:06 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RLEcBKIzhB7Tbm9ROqjTPLghFRp8eFI02TUwBdaallZLow0s%2Fi4gblOS4IfiV%2B8cgmyWXiKMzRUfNlvc%2BfOFEmtbWT%2Frk5hjKjvD%2FgYI4JXOQu9QNOYT5UUB3iomMceRxaB36s7EEplsRg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cf-ray
6c45f0a42950839a-MXP
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
43
0.3531389733863395.jpg
0.7741967837596948.crdms.images.consumerreports.org/
0
0

0.4824590405971354.jpg
0.8960949746845492.sql1q12u73.com/
0
0

0.5129498484656607.jpg
0.7929753465072389.crdms.images.consumerreports.org/
0
0

0.031782282148969054.jpg
0.5635416321832127.sql1q12u73.com/
0
0

0.5845436490188904.jpg
0.10268002850319169.crdms.images.consumerreports.org/
0
0

0.6895848364000594.jpg
0.770505820783024.sql1q12u73.com/
0
0

0.42816311880560254.jpg
0.30217042235801594.crdms.images.consumerreports.org/
0
0

0.08816739410646668.jpg
0.8054052511725653.sql1q12u73.com/
0
0

0041.png
songlos.com/
4 KB
5 KB
Image
General
Full URL
https://songlos.com/0041.png
Requested by
Host: songlos.com
URL: https://songlos.com/xRf0vWNOQsKb.php?pid=0552c379zwfhqfe9
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:cb25 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bf89e5fb2a02f3986cd32dc49fa987f9d50f4c55f2c787da7aff1644a5f7b8b0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://songlos.com/xRf0vWNOQsKb.php?pid=0552c379zwfhqfe9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Mon, 27 Dec 2021 22:21:09 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1340867
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
4488
last-modified
Sun, 12 Dec 2021 09:50:17 GMT
server
cloudflare
etag
"61b5c5d9-1188"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3rRyBcQblTqskZBk6D0MTU%2FZLBiOUew6vUc38%2BqIDtt0vzw53VeimPiV8bAiA82ENT0tXqwZAgfGp4kpCIwlPAXyFeQe8%2FIIzqAh%2BmIW3j8qgZMuZnrfMSLcE4ONdfeeBImlDPceeY8aHA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=315360000
accept-ranges
bytes
cf-ray
6c45f0b6bb4d839a-MXP
expires
Thu, 31 Dec 2037 23:55:55 GMT
0.9478739101469058.jpg
0.30611903540665075.crdms.images.consumerreports.org/
0
0

0.648833319673014.jpg
0.20691222325400216.sql1q12u73.com/
0
0

0.7042643679984681.jpg
0.6424261585771154.crdms.images.consumerreports.org/
0
0

0.2856329210205766.jpg
0.4001026704527948.sql1q12u73.com/
0
0

0.9741192421347282.jpg
0.7809929738817631.crdms.images.consumerreports.org/
0
0

0.5078995359858234.jpg
0.40236107711458335.sql1q12u73.com/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
0.7741967837596948.crdms.images.consumerreports.org
URL
https://0.7741967837596948.crdms.images.consumerreports.org/0.3531389733863395.jpg
Domain
0.8960949746845492.sql1q12u73.com
URL
https://0.8960949746845492.sql1q12u73.com/0.4824590405971354.jpg
Domain
0.7929753465072389.crdms.images.consumerreports.org
URL
https://0.7929753465072389.crdms.images.consumerreports.org/0.5129498484656607.jpg
Domain
0.5635416321832127.sql1q12u73.com
URL
https://0.5635416321832127.sql1q12u73.com/0.031782282148969054.jpg
Domain
0.10268002850319169.crdms.images.consumerreports.org
URL
https://0.10268002850319169.crdms.images.consumerreports.org/0.5845436490188904.jpg
Domain
0.770505820783024.sql1q12u73.com
URL
https://0.770505820783024.sql1q12u73.com/0.6895848364000594.jpg
Domain
0.30217042235801594.crdms.images.consumerreports.org
URL
https://0.30217042235801594.crdms.images.consumerreports.org/0.42816311880560254.jpg
Domain
0.8054052511725653.sql1q12u73.com
URL
https://0.8054052511725653.sql1q12u73.com/0.08816739410646668.jpg
Domain
0.30611903540665075.crdms.images.consumerreports.org
URL
https://0.30611903540665075.crdms.images.consumerreports.org/0.9478739101469058.jpg
Domain
0.20691222325400216.sql1q12u73.com
URL
https://0.20691222325400216.sql1q12u73.com/0.648833319673014.jpg
Domain
0.6424261585771154.crdms.images.consumerreports.org
URL
https://0.6424261585771154.crdms.images.consumerreports.org/0.7042643679984681.jpg
Domain
0.4001026704527948.sql1q12u73.com
URL
https://0.4001026704527948.sql1q12u73.com/0.2856329210205766.jpg
Domain
0.7809929738817631.crdms.images.consumerreports.org
URL
https://0.7809929738817631.crdms.images.consumerreports.org/0.9741192421347282.jpg
Domain
0.40236107711458335.sql1q12u73.com
URL
https://0.40236107711458335.sql1q12u73.com/0.5078995359858234.jpg

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

number| intervalID function| myCallback function| changeimageW function| findIP function| addIP function| checkSize function| changeimage function| myFunction

3 Cookies

Domain/Path Name / Value
songlos.com/ Name: PHPSESSID
Value: as6v3setg45kf19snviuivniuk
.songlos.com/ Name: _subid
Value: 398588e4n9h8
.songlos.com/ Name: b7dab
Value: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjEwXCI6MTY0MDY0MzY2Nn0sXCJjYW1wYWlnbnNcIjp7XCIxXCI6MTY0MDY0MzY2Nn0sXCJ0aW1lXCI6MTY0MDY0MzY2Nn0ifQ.12IcAKIUn1CKM5_5satJqoigBPw823d2wCFQFAxadgA

7 Console Messages

Source Level URL
Text
network error URL: https://0.7741967837596948.crdms.images.consumerreports.org/0.3531389733863395.jpg
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network error URL: https://0.7929753465072389.crdms.images.consumerreports.org/0.5129498484656607.jpg
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network error URL: https://0.10268002850319169.crdms.images.consumerreports.org/0.5845436490188904.jpg
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network error URL: https://0.30217042235801594.crdms.images.consumerreports.org/0.42816311880560254.jpg
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network error URL: https://0.30611903540665075.crdms.images.consumerreports.org/0.9478739101469058.jpg
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network error URL: https://0.6424261585771154.crdms.images.consumerreports.org/0.7042643679984681.jpg
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network error URL: https://0.7809929738817631.crdms.images.consumerreports.org/0.9741192421347282.jpg
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0.10268002850319169.crdms.images.consumerreports.org
0.20691222325400216.sql1q12u73.com
0.30217042235801594.crdms.images.consumerreports.org
0.30611903540665075.crdms.images.consumerreports.org
0.4001026704527948.sql1q12u73.com
0.40236107711458335.sql1q12u73.com
0.5635416321832127.sql1q12u73.com
0.6424261585771154.crdms.images.consumerreports.org
0.770505820783024.sql1q12u73.com
0.7741967837596948.crdms.images.consumerreports.org
0.7809929738817631.crdms.images.consumerreports.org
0.7929753465072389.crdms.images.consumerreports.org
0.8054052511725653.sql1q12u73.com
0.8960949746845492.sql1q12u73.com
songlos.com
www.supersong.nl
0.10268002850319169.crdms.images.consumerreports.org
0.20691222325400216.sql1q12u73.com
0.30217042235801594.crdms.images.consumerreports.org
0.30611903540665075.crdms.images.consumerreports.org
0.4001026704527948.sql1q12u73.com
0.40236107711458335.sql1q12u73.com
0.5635416321832127.sql1q12u73.com
0.6424261585771154.crdms.images.consumerreports.org
0.770505820783024.sql1q12u73.com
0.7741967837596948.crdms.images.consumerreports.org
0.7809929738817631.crdms.images.consumerreports.org
0.7929753465072389.crdms.images.consumerreports.org
0.8054052511725653.sql1q12u73.com
0.8960949746845492.sql1q12u73.com
185.37.71.70
2606:4700:3035::ac43:cb25
278a18a358045b3838739d2ccce2e35a1472921a10fc1eb1ee94fa0429ab9d63
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
b296258e88842b62e722d4fd34b4642d5b23121368decec801ed98ed284d0de4
bf89e5fb2a02f3986cd32dc49fa987f9d50f4c55f2c787da7aff1644a5f7b8b0