www.bfst.xyz Open in urlscan Pro
2606:4700:3031::681b:bc12 Public Scan

Go To Rescan
Add Verdict Report

URL:
http://www.bfst.xyz/seven.php
Submission: On September 25 via api (September 25th 2020, 9:32:53 am UTC) from US

Summary HTTP 17 Redirects Behaviour Indicators

Summary

This website contacted 12 IPs in 6 countries across 10 domains to perform 17 HTTP transactions. The main IP is 2606:4700:3031::681b:bc12, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.bfst.xyz.

This is the only time www.bfst.xyz was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	2606:4700:303... 2606:4700:3031::681b:bc12	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	192.243.59.13 192.243.59.13	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
4	2a04:4e42:1b:... 2a04:4e42:1b::621	54113 (FASTLY) (FASTLY)
1	2606:4700:20:... 2606:4700:20::681a:407	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	2001:470:1f0a... 2001:470:1f0a:716::2	6939 (HURRICANE) (HURRICANE)
2	2606:4700::68... 2606:4700::6811:c36b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	46.105.201.240 46.105.201.240	16276 (OVH) (OVH)
1	158.69.248.123 158.69.248.123	16276 (OVH) (OVH)
1	2606:4700:303... 2606:4700:3035::6812:3747	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	2a00:1a28:151... 2a00:1a28:1510:9::5271	42708 (PORTLANE ...) (PORTLANE www.portlane.com)
1	35.190.71.96 35.190.71.96	15169 (GOOGLE) (GOOGLE)
17	12

1 2606:4700:3031::681b:bc12 (United States)

ASN13335 (CLOUDFLARENET, US)

www.bfst.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.243.59.13 (Ashburn, United States)

ASN39572 (ADVANCEDHOSTERS-AS, NL)

zlsvr3xybeh4.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a04:4e42:1b::621 (Ascension Island)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::681a:407 (United States)

ASN13335 (CLOUDFLARENET, US)

waust.at	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:470:1f0a:716::2 (Russian Federation) 1 redirects

ASN6939 (HURRICANE, US)

livecounter.theyosh.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:c36b (United States)

ASN13335 (CLOUDFLARENET, US)

celeritascdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 46.105.201.240 (France)

ASN16276 (OVH, FR)

s10.histats.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 158.69.248.123 (Montreal, Canada)

ASN16276 (OVH, FR)
PTR: ns542881.ip-158-69-248.net

s4.histats.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3035::6812:3747 (United States)

ASN13335 (CLOUDFLARENET, US)

ufpcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1a28:1510:9::5271 (Stockholm, Sweden) 1 redirects

ASN42708 (PORTLANE www.portlane.com, SE)

cdn.livecounter.theyosh.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.71.96 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 96.71.190.35.bc.googleusercontent.com

onclickgenius.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	theyosh.nl 2 redirects livecounter.theyosh.nl cdn.livecounter.theyosh.nl	1 KB
4	jsdelivr.net cdn.jsdelivr.net	160 KB
2	histats.com s10.histats.com s4.histats.com	5 KB
2	celeritascdn.com celeritascdn.com	21 KB
1	onclickgenius.com onclickgenius.com	132 B
1	ufpcdn.com ufpcdn.com
1	waust.at waust.at	8 KB
1	zlsvr3xybeh4.com zlsvr3xybeh4.com
1	bfst.xyz www.bfst.xyz	118 KB
0	Failed function sub() { [native code] }. Failed
17	10

	Domain	Requested by
4	cdn.jsdelivr.net	www.bfst.xyz
2	cdn.livecounter.theyosh.nl	1 redirects livecounter.theyosh.nl
2	celeritascdn.com	www.bfst.xyz
2	livecounter.theyosh.nl	1 redirects www.bfst.xyz
1	onclickgenius.com	www.bfst.xyz
1	ufpcdn.com	www.bfst.xyz
1	s4.histats.com	s10.histats.com
1	s10.histats.com	www.bfst.xyz
1	waust.at	www.bfst.xyz
1	zlsvr3xybeh4.com	www.bfst.xyz
1	www.bfst.xyz
0	34.120.97.249 Failed	cdn.jsdelivr.net
17	12

This site contains no links.

Subject Issuer	Validity	Valid
f3.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2020-09-21` - `2021-04-17`	7 months	crt.sh
theyosh.nl Let's Encrypt Authority X3	`2020-09-12` - `2020-12-11`	3 months	crt.sh
histats.com Let's Encrypt Authority X3	`2020-09-08` - `2020-12-07`	3 months	crt.sh
cdn.livecounter.theyosh.nl Let's Encrypt Authority X3	`2020-09-10` - `2020-12-09`	3 months	crt.sh

This page contains 3 frames:

Primary Page: http://www.bfst.xyz/seven.php
Frame ID: 58F381C388A8526B3CA8321B53AA6141
Requests: 15 HTTP requests in this frame

Frame: http://ufpcdn.com/script/identify.html?frmt=0
Frame ID: BB57421BD4C2BA6741A73F752EEF5E11
Requests: 1 HTTP requests in this frame

Frame: https://cdn.livecounter.theyosh.nl/8935.html
Frame ID: 36F645946E09BC3292D1168DBD40AE5A
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

17
Requests

41 %
HTTPS

64 %
IPv6

10
Domains

12
Subdomains

12
IPs

6
Countries

312 kB
Transfer

1049 kB
Size

9
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 6

http://livecounter.theyosh.nl/8935.js HTTP 301
https://livecounter.theyosh.nl/8935.js

Request Chain 12

http://cdn.livecounter.theyosh.nl/8935.html HTTP 301
https://cdn.livecounter.theyosh.nl/8935.html

17 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set seven.php Show response
www.bfst.xyz/ 340 KB
118 KB 62ms
46ms Document
text/html 2606:4700:3031::681b:bc12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://www.bfst.xyz/seven.php
Protocol: HTTP/1.1
Server: 2606:4700:3031::681b:bc12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 356e3ace309d81208b7bcae1e43f270011a5ab336943806c6488efd33dbe636b

Request headers

Host: www.bfst.xyz
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 09:32:36 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d41f7bd1a5470f2ed3ff8da3a90daf2281601026356; expires=Sun, 25-Oct-20 09:32:36 GMT; path=/; domain=.bfst.xyz; HttpOnly; SameSite=Lax
Vary: Accept-Encoding Accept-Encoding
X-Turbo-Charged-By: LiteSpeed
G7Cache-10G: HIT
CF-Cache-Status: DYNAMIC
cf-request-id: 0566348cd100002c0d84314200000001
Server: cloudflare
CF-RAY: 5d83bd27ba9b2c0d-FRA
Content-Encoding: gzip

GET
H/1.1 403
Forbidden 7028b257c6702101190fa525b7cc585c.js
zlsvr3xybeh4.com/70/28/b2/ 0
0 222ms
193ms Script
application/javascript 192.243.59.13
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://zlsvr3xybeh4.com/70/28/b2/7028b257c6702101190fa525b7cc585c.js
Requested by: Host: www.bfst.xyz
URL: http://www.bfst.xyz/seven.php
Protocol: HTTP/1.1
Server: 192.243.59.13 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.17.6 /
Resource Hash

Request headers

Referer: http://www.bfst.xyz/seven.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 25 Sep 2020 09:32:36 GMT
Server: nginx/1.17.6
Connection: keep-alive
Content-Type: application/javascript
Content-Length: 0
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

GET
H2 200 clappr.min.js Show response
cdn.jsdelivr.net/clappr/latest/ 517 KB
127 KB 7ms
6ms Script
application/javascript 2a04:4e42:1b::621
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/clappr/latest/clappr.min.js

Requested by

Host: www.bfst.xyz
URL: http://www.bfst.xyz/seven.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::621 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

cbcf0e85e906f9e8caf296fc6fd0cb8fcfb69b31e9ac570d63bd837fcf743f6f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://www.bfst.xyz/seven.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 4774920
x-cache: HIT, HIT
status: 200
content-length: 129736
etag: W/"8156e-D6xFiaxzMytsrOCcfMOmYtKY+qo"
x-served-by: cache-fra19146-FRA, cache-hhn4067-HHN
date: Fri, 25 Sep 2020 09:32:36 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 level-selector.min.js Show response
cdn.jsdelivr.net/clappr.level-selector/latest/ 9 KB
3 KB 10ms
8ms Script
application/javascript 2a04:4e42:1b::621
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/clappr.level-selector/latest/level-selector.min.js

Requested by

Host: www.bfst.xyz
URL: http://www.bfst.xyz/seven.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::621 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

23a715a6d8a35921f8c02eab19a93b6c9c42271ecfccbde0005476959e2edff9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://www.bfst.xyz/seven.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 4991453
x-cache: HIT, HIT
status: 200
content-length: 3061
etag: W/"2524-9Cxz5uiSAcz1rVE5FbtBguw6QQw"
x-served-by: cache-fra19151-FRA, cache-hhn4067-HHN
date: Fri, 25 Sep 2020 09:32:36 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 hlsjs-p2p-engine.min.js Show response
cdn.jsdelivr.net/npm/cdnbye@latest/dist/ 98 KB
29 KB 14ms
13ms Script
application/javascript 2a04:4e42:1b::621
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/cdnbye@latest/dist/hlsjs-p2p-engine.min.js

Requested by

Host: www.bfst.xyz
URL: http://www.bfst.xyz/seven.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::621 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

e1dc22fe386b4b9b1c745705006391fbf4ec9e8d1069972cfe6ae1a10fefa17f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://www.bfst.xyz/seven.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 21182
x-cache: HIT, HIT
status: 200
cross-origin-resource-policy: cross-origin
content-length: 29301
etag: W/"18780-LpT087SHy/TPWxN2IVo0v5X9pLc"
x-served-by: cache-fra19141-FRA, cache-hhn4067-HHN
date: Fri, 25 Sep 2020 09:32:36 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 clappr-plugin.min.js Show response
cdn.jsdelivr.net/npm/cdnbye@latest/dist/ 3 KB
1 KB 13ms
12ms Script
application/javascript 2a04:4e42:1b::621
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/cdnbye@latest/dist/clappr-plugin.min.js

Requested by

Host: www.bfst.xyz
URL: http://www.bfst.xyz/seven.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::621 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

75bd806cedfbb8345056d85741118c48d3d54b910410e9845a4f8d5073eeb558

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://www.bfst.xyz/seven.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 29036
x-cache: HIT, HIT
status: 200
cross-origin-resource-policy: cross-origin
content-length: 1137
etag: W/"b7a-xrHVogjSh9UgCA6avhjMzbTd9uk"
x-served-by: cache-fra19126-FRA, cache-hhn4067-HHN
date: Fri, 25 Sep 2020 09:32:36 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H/1.1 200
OK d.js Show response
waust.at/ 13 KB
8 KB 29ms
23ms Script
application/x-javascript 2606:4700:20::681a:407
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://waust.at/d.js
Requested by: Host: www.bfst.xyz
URL: http://www.bfst.xyz/seven.php
Protocol: HTTP/1.1
Server: 2606:4700:20::681a:407 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: efa8c2057af08d12b4e74599705c6e88f36bda5f4ec712fe58d1286a159fcfa6

Request headers

Referer: http://www.bfst.xyz/seven.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 09:32:36 GMT
content-encoding: gzip
CF-Cache-Status: HIT
Age: 1767
Transfer-Encoding: chunked
Connection: keep-alive
cf-request-id: 0566348e3700002bd2bf266200000001
last-modified: Thu, 17 Sep 2020 19:20:18 GMT
Server: cloudflare
etag: W/"5f63b6f2-33b6"
Vary: Accept-Encoding
Content-Type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=86400
CF-RAY: 5d83bd29ff922bd2-FRA
expires: Sat, 26 Sep 2020 09:03:09 GMT

GET
H2

200

8935.js Show response
livecounter.theyosh.nl/
Redirect Chain

http://livecounter.theyosh.nl/8935.js
https://livecounter.theyosh.nl/8935.js

374 B
435 B

238ms
108ms

Script
application/javascript

2001:470:1f0a:716::2
HURRICANE

General

Check archive.org

Show headers Download Go to

Full URL

https://livecounter.theyosh.nl/8935.js

Requested by

Host: www.bfst.xyz
URL: http://www.bfst.xyz/seven.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2001:470:1f0a:716::2 , Russian Federation, ASN6939 (HURRICANE, US),

Reverse DNS

Software

nginx /

Resource Hash

d39584af654bfe9668855dc03d0b61cc679a56b3c2648e5fe54c5e1c544d78f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: http://www.bfst.xyz/seven.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-version: LUA:1.0
date: Fri, 25 Sep 2020 09:32:36 GMT
content-encoding: gzip
server: nginx
status: 200
strict-transport-security: max-age=15768000
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=691200
expires: Sat, 03 Oct 2020 09:32:36 GMT

Redirect headers

X-Version: LUA:1.0
Date: Fri, 25 Sep 2020 09:32:36 GMT
Server: nginx
Location: https://livecounter.theyosh.nl/8935.js
Strict-Transport-Security: max-age=15768000
Content-Type: text/html
Access-Control-Allow-Origin: *
Connection: keep-alive
Keep-Alive: timeout=2
Content-Length: 162

GET
H/1.1 200
OK compatibility.js Show response
celeritascdn.com/script/ 20 KB
9 KB 27ms
13ms Script
application/javascript 2606:4700::6811:c36b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://celeritascdn.com/script/compatibility.js
Requested by: Host: www.bfst.xyz
URL: http://www.bfst.xyz/seven.php
Protocol: HTTP/1.1
Server: 2606:4700::6811:c36b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 03241a470052a86e3d0bc4c77894ae3f87a1452092fff62ff01d499ead7decac

Request headers

Referer: http://www.bfst.xyz/seven.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 09:32:36 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
Age: 1759
X-GUploader-UploadID: ABg5-UxkH0G-9-4VoNWEwVI0tS5BuUlU7cUGfFLQWBJjmNgGxxdIQrWo11Vs0yHVqzX_2GDCmkyR1_Hekw-Z5KAbFEE
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
Connection: keep-alive
Content-Type: application/javascript
cf-request-id: 0566348e6500001f41c1233200000001
Last-Modified: Tue, 15 Sep 2020 12:10:32 GMT
Server: cloudflare
ETag: W/"c2bbc1e2544049cb035c321919bef2bc"
Vary: Accept-Encoding
x-goog-hash: crc32c=6TBdZQ==, md5=wrvB4lRAScsDXDIZGb7yvA==
x-goog-generation: 1600171832181211
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=14400
Transfer-Encoding: chunked
x-goog-stored-content-length: 20647
CF-RAY: 5d83bd2a3b4e1f41-FRA
Expires: Fri, 25 Sep 2020 13:32:36 GMT

GET
H/1.1 200
OK js15_as.js Show response
s10.histats.com/ 11 KB
5 KB 48ms
32ms Script
text/javascript 46.105.201.240
OVH

General

Check archive.org

Show headers Download Go to

Full URL: http://s10.histats.com/js15_as.js
Requested by: Host: www.bfst.xyz
URL: http://www.bfst.xyz/seven.php
Protocol: HTTP/1.1
Server: 46.105.201.240 , France, ASN16276 (OVH, FR),
Reverse DNS
Software: /
Resource Hash: 2defe59e357a7d0683c8283ac42841db404a0884cae2eaecebf4b676e559dede

Request headers

Referer: http://www.bfst.xyz/seven.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 09:29:37 GMT
Content-Encoding: gzip
Last-Modified: Thu, 16 Apr 2020 10:44:16 GMT
X-CDN-Pop-IP: 137.74.120.32/27
ETag: "-375139978"
X-Cacheable: Matched cache
Vary: Accept-Encoding
X-IPLB-Instance: 4760
Content-Type: text/javascript
X-CDN-Pop: sbg
Accept-Ranges: bytes
Content-Length: 4547
X-Request-ID: 1005159143

GET
H/1.1 200
OK 0.php Show response
s4.histats.com/stats/ 51 B
322 B 326ms
108ms Script
text/html 158.69.248.123
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://s4.histats.com/stats/0.php?4275943&@f16&@g1&@h1&@i1&@j1601026356927&@k0&@l1&@m&@n0&@o1000&@q0&@r0&@s0&@ten-US&@u1600&@b1:-161269971&@b3:1601026357&@b4:js15_as.js&@b5:120&@a-_0.2.1&@vhttp%3A%2F%2Fwww.bfst.xyz%2Fseven.php&@w
Requested by: Host: s10.histats.com
URL: http://s10.histats.com/js15_as.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 158.69.248.123 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS: ns542881.ip-158-69-248.net
Software: /
Resource Hash: 5ee308ae579747169dbf033bc365567c9fdf64b92053564adcd273b799a40548

Request headers

Referer: http://www.bfst.xyz/seven.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 09:32:37 GMT
Connection: close
Content-Length: 51
Content-Type: text/html;charset=UTF-8

GET index.m3u8
34.120.97.249/live/g/ 0
0

GET
H/1.1 200
OK Cookie set identify.html
ufpcdn.com/script/ Frame BB57 0
0 359ms
353ms Document
text/html 2606:4700:3035::6812:3747
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://ufpcdn.com/script/identify.html?frmt=0
Requested by: Host: www.bfst.xyz
URL: http://www.bfst.xyz/seven.php
Protocol: HTTP/1.1
Server: 2606:4700:3035::6812:3747 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Host: ufpcdn.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://www.bfst.xyz/seven.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://www.bfst.xyz/seven.php

Response headers

Date: Fri, 25 Sep 2020 09:32:37 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=ddd085647bde7ad113ac12d0acd64edbe1601026356; expires=Sun, 25-Oct-20 09:32:36 GMT; path=/; domain=.ufpcdn.com; HttpOnly; SameSite=Lax __cf_bm=a91af9374f56c2b32599675fd4718427bc47ef77-1601026357-1800-AduTq9VqqPHGPx6Ui/MegzZnbb4uz+QgyED/27Stnv6NMg6gIb2uI9LdGqmGIph0Ul8qwHXk1qIqw3czEnQLZVM=; path=/; expires=Fri, 25-Sep-20 10:02:37 GMT; domain=.ufpcdn.com; HttpOnly; SameSite=None
Last-Modified: Tue, 15 May 2018 06:39:25 GMT
CF-Cache-Status: DYNAMIC
cf-request-id: 0566348ed00000969e7a292200000001
Server: cloudflare
CF-RAY: 5d83bd2aef97969e-FRA
Content-Encoding: gzip

GET
H2

200

8935.html
cdn.livecounter.theyosh.nl/ Frame 36F6
Redirect Chain

http://cdn.livecounter.theyosh.nl/8935.html
https://cdn.livecounter.theyosh.nl/8935.html

0
0

113ms
37ms

Document
text/html

2a00:1a28:1510:9::5271
PORTLANE www.port...

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.livecounter.theyosh.nl/8935.html

Requested by

Host: livecounter.theyosh.nl
URL: http://livecounter.theyosh.nl/8935.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a00:1a28:1510:9::5271 Stockholm, Sweden, ASN42708 (PORTLANE www.portlane.com, SE),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

:method: GET
:authority: cdn.livecounter.theyosh.nl
:scheme: https
:path: /8935.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://www.bfst.xyz/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://www.bfst.xyz/

Response headers

status: 200
server: nginx
date: Fri, 25 Sep 2020 09:32:37 GMT
content-type: text/html; charset=utf-8
expires: Wed, 30 Sep 2020 10:06:00 GMT
cache-control: max-age=691200
x-version: LUA:1.0
access-control-allow-origin: *
strict-transport-security: max-age=15768000
x-content-type-options: nosniff
x-xss-protection: 1
referrer-policy: strict-origin-when-cross-origin
content-encoding: gzip

Redirect headers

Server: nginx
Date: Fri, 25 Sep 2020 09:32:37 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Location: https://cdn.livecounter.theyosh.nl/8935.html
Strict-Transport-Security: max-age=15768000
X-Content-Type-Options: nosniff
X-XSS-Protection: 1
Referrer-Policy: strict-origin-when-cross-origin

GET
H/1.1 204
No Content suurl.php Show response
onclickgenius.com/script/ 0
132 B 162ms
148ms Script
text/plain 35.190.71.96
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: http://onclickgenius.com/script/suurl.php?r=2466091&cbrandom=0.3389657109582527&cbiframe=0&cbWidth=1600&cbHeight=1200&cbtitle=&cbref=&cbdescription=&cbkeywords=&cbcdn=celeritascdn.com
Requested by: Host: www.bfst.xyz
URL: http://www.bfst.xyz/seven.php
Protocol: HTTP/1.1
Server: 35.190.71.96 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 96.71.190.35.bc.googleusercontent.com
Software: openresty /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://www.bfst.xyz/seven.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 25 Sep 2020 09:32:37 GMT
Via: 1.1 google
Server: openresty

GET
H/1.1 200
OK chrome.js Show response
celeritascdn.com/script/ 36 KB
12 KB 12ms
12ms Script
application/javascript 2606:4700::6811:c36b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://celeritascdn.com/script/chrome.js
Requested by: Host: www.bfst.xyz
URL: http://www.bfst.xyz/seven.php
Protocol: HTTP/1.1
Server: 2606:4700::6811:c36b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 59f4d7efe6da31323c45da80772acec8cd177a21530c2de576f86ee3fcefd946

Request headers

Referer: http://www.bfst.xyz/seven.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 09:32:37 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
Age: 1943
X-GUploader-UploadID: ABg5-UzjdAhGvQK2XT7EqUMQ0h8TtggLA284hfvePTwegnuGVGTu-5C9Tv5kRLeA57rkuqI3C-TTPniuONITlOrjN9fAqlU3Sg
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
Connection: keep-alive
Content-Type: application/javascript
cf-request-id: 0566348f9200001f41c123f200000001
Last-Modified: Mon, 14 Sep 2020 09:15:29 GMT
Server: cloudflare
ETag: W/"ef6565ab259dafbc08468b4d0bb46762"
Vary: Accept-Encoding
x-goog-hash: crc32c=KoLUvQ==, md5=72VlqyWdr7wIRotNC7RnYg==
x-goog-generation: 1600074929755781
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=14400
Transfer-Encoding: chunked
x-goog-stored-content-length: 37300
CF-RAY: 5d83bd2c1f831f41-FRA
Expires: Fri, 25 Sep 2020 13:32:37 GMT

GET index.m3u8
34.120.97.249/live/g/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: 34.120.97.249
URL: http://34.120.97.249/live/g/index.m3u8

Domain: 34.120.97.249
URL: http://34.120.97.249/live/g/index.m3u8

Verdicts & Comments Add Verdict or Comment

58 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

9 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.bfst.xyz/	1970-01-19 14:10:10	Name: adcashufpv3 Value: 84490988119308762671229675244
www.bfst.xyz/	1970-01-19 21:29:22	Name: HstPt4275943 Value: 1
www.bfst.xyz/	1970-01-19 21:29:22	Name: HstCnv4275943 Value: 1
www.bfst.xyz/	1970-01-19 21:29:22	Name: HstCla4275943 Value: 1601026356927
www.bfst.xyz/	1970-01-19 21:29:22	Name: HstCns4275943 Value: 1
www.bfst.xyz/	1970-01-19 21:29:22	Name: HstCmu4275943 Value: 1601026356927
www.bfst.xyz/	1970-01-19 21:29:22	Name: HstPn4275943 Value: 1
www.bfst.xyz/	1970-01-19 21:29:22	Name: HstCfa4275943 Value: 1601026356927
.bfst.xyz/	1970-01-19 13:26:58	Name: __cfduid Value: d41f7bd1a5470f2ed3ff8da3a90daf2281601026356

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

34.120.97.249
cdn.jsdelivr.net
cdn.livecounter.theyosh.nl
celeritascdn.com
livecounter.theyosh.nl
onclickgenius.com
s10.histats.com
s4.histats.com
ufpcdn.com
waust.at
www.bfst.xyz
zlsvr3xybeh4.com
34.120.97.249
158.69.248.123
192.243.59.13
2001:470:1f0a:716::2
2606:4700:20::681a:407
2606:4700:3031::681b:bc12
2606:4700:3035::6812:3747
2606:4700::6811:c36b
2a00:1a28:1510:9::5271
2a04:4e42:1b::621
35.190.71.96
46.105.201.240
03241a470052a86e3d0bc4c77894ae3f87a1452092fff62ff01d499ead7decac
23a715a6d8a35921f8c02eab19a93b6c9c42271ecfccbde0005476959e2edff9
2defe59e357a7d0683c8283ac42841db404a0884cae2eaecebf4b676e559dede
356e3ace309d81208b7bcae1e43f270011a5ab336943806c6488efd33dbe636b
59f4d7efe6da31323c45da80772acec8cd177a21530c2de576f86ee3fcefd946
5ee308ae579747169dbf033bc365567c9fdf64b92053564adcd273b799a40548
75bd806cedfbb8345056d85741118c48d3d54b910410e9845a4f8d5073eeb558
cbcf0e85e906f9e8caf296fc6fd0cb8fcfb69b31e9ac570d63bd837fcf743f6f
d39584af654bfe9668855dc03d0b61cc679a56b3c2648e5fe54c5e1c544d78f8
e1dc22fe386b4b9b1c745705006391fbf4ec9e8d1069972cfe6ae1a10fefa17f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
efa8c2057af08d12b4e74599705c6e88f36bda5f4ec712fe58d1286a159fcfa6

www.bfst.xyz Open in urlscan Pro 2606:4700:3031::681b:bc12 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

17 Requests

41 %HTTPS

64 %IPv6

10 Domains

12 Subdomains

12 IPs

6 Countries

312 kBTransfer

1049 kBSize

9 Cookies

0 Outgoing links

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

58 JavaScript Global Variables

9 Cookies

Indicators

www.bfst.xyz Open in urlscan Pro
2606:4700:3031::681b:bc12 Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

41 %
HTTPS

64 %
IPv6

10
Domains

12
Subdomains

12
IPs

6
Countries

312 kB
Transfer

1049 kB
Size

9
Cookies

17 HTTP transactions
0 data transactions