Submitted URL: https://update.jukola.info/
Effective URL: http://update.buh.by/
Submission: On January 27 via automatic, source certstream-suspicious

Summary

This website contacted 4 IPs in 2 countries across 5 domains to perform 8 HTTP transactions. The main IP is 212.98.162.47, located in Minsk, Belarus and belongs to BN-AS Belarussian data communication service provider., BY. The main domain is update.buh.by.
This is the only time update.buh.by was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 3 212.98.162.47 12406 (BN-AS Bel...)
1 1 178.172.160.2 6697 (BELPAK-AS...)
1 2a0a:7d80::cafe 6697 (BELPAK-AS...)
1 5 217.69.133.145 47764 (MAILRU-AS...)
8 4
Apex Domain
Subdomains
Transfer
5 mail.ru
top-fwz1.mail.ru
13 KB
2 buh.by
update.buh.by
6 KB
1 tam.by
tam.by
2 KB
1 tut.by
catalog.tut.by
87 B
1 jukola.info
update.jukola.info
bm2017.jukola.info Failed
293 B
8 5
Domain Requested by
5 top-fwz1.mail.ru 1 redirects update.buh.by
top-fwz1.mail.ru
2 update.buh.by update.buh.by
1 tam.by update.buh.by
1 catalog.tut.by 1 redirects
1 update.jukola.info 1 redirects
0 bm2017.jukola.info Failed update.buh.by
8 6

This site contains links to these domains. Also see Links.

Domain
www.jukola.by
buh.by
update2.buh.by
www.buh.by
catalog.tut.by
top.mail.ru
Subject Issuer Validity Valid
*.tam.by
RapidSSL RSA CA 2018
2019-12-16 -
2021-01-14
a year crt.sh
*.mail.ru
GlobalSign Organization Validation CA - SHA256 - G2
2019-01-18 -
2021-01-18
2 years crt.sh

This page contains 2 frames:

Primary Page: http://update.buh.by/
Frame ID: 4EFD61F74735B4F098BEC60A522F5BB6
Requests: 7 HTTP requests in this frame

Frame: https://bm2017.jukola.info/abmw.asp?z=7&isframe=true&autorotate=true
Frame ID: 4A0546F3B83780A23CB0DCAC8BDEAF79
Requests: 1 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://update.jukola.info/ HTTP 302
    http://update.buh.by/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i

Overall confidence: 100%
Detected patterns
  • headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i

Page Statistics

8
Requests

50 %
HTTPS

25 %
IPv6

5
Domains

6
Subdomains

4
IPs

2
Countries

20 kB
Transfer

31 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://update.jukola.info/ HTTP 302
    http://update.buh.by/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • https://catalog.tut.by/images/catalog-tut.gif HTTP 301
  • https://tam.by/images/catalog-tut.gif
Request Chain 2
  • http://top-fwz1.mail.ru/counter?id=942103;t=479;l=1 HTTP 302
  • https://top-fwz1.mail.ru/counter?id=942103;t=479;l=1

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request Cookie set /
update.buh.by/
Redirect Chain
  • https://update.jukola.info/
  • http://update.buh.by/
10 KB
5 KB
Document
General
Full URL
http://update.buh.by/
Protocol
HTTP/1.1
Server
212.98.162.47 Minsk, Belarus, ASN12406 (BN-AS Belarussian data communication service provider., BY),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
a964f54095c5f6c513e3255100166b4fac7aad9513113ab958242db4fdaaed34

Request headers

Host
update.buh.by
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Sec-Fetch-User
?1

Response headers

Cache-Control
private
Content-Type
text/html
Content-Encoding
gzip
Vary
Accept-Encoding
Server
Microsoft-IIS/8.5
Set-Cookie
ASPSESSIONIDQSRDDSAS=FHGNKEDDILNLBFNAEENHLKGD; path=/
X-Powered-By
ASP.NET
Date
Mon, 27 Jan 2020 08:35:28 GMT
Content-Length
4523

Redirect headers

Cache-Control
private
Content-Type
text/html
Location
http://update.buh.by
Server
Microsoft-IIS/8.5
Set-Cookie
ASPSESSIONIDQWRDDSAS=EHGNKEDDLCNMBENKJKDOPIJN; secure; path=/
X-Powered-By
ASP.NET
Date
Mon, 27 Jan 2020 08:35:28 GMT
Content-Length
149
style.css
update.buh.by/
1 KB
834 B
Stylesheet
General
Full URL
http://update.buh.by/style.css
Requested by
Host: update.buh.by
URL: http://update.buh.by/
Protocol
HTTP/1.1
Server
212.98.162.47 Minsk, Belarus, ASN12406 (BN-AS Belarussian data communication service provider., BY),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
32a158691bd1ab83c6644c00abfa9190da82ee8edb168693e429aef20cdb2406

Request headers

Referer
http://update.buh.by/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Mon, 27 Jan 2020 08:35:28 GMT
Content-Encoding
gzip
ETag
"064b784fc2cd1:0"
Last-Modified
Wed, 14 Nov 2012 10:04:44 GMT
Server
Microsoft-IIS/8.5
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
text/css
Accept-Ranges
bytes
Content-Length
543
catalog-tut.gif
tam.by/images/
Redirect Chain
  • https://catalog.tut.by/images/catalog-tut.gif
  • https://tam.by/images/catalog-tut.gif
2 KB
2 KB
Image
General
Full URL
https://tam.by/images/catalog-tut.gif
Requested by
Host: update.buh.by
URL: http://update.buh.by/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a0a:7d80::cafe Minsk, Belarus, ASN6697 (BELPAK-AS BELPAK, BY),
Reverse DNS
Software
nginx /
Resource Hash
714b2cfbe54644ede3b94b88c38d8ff90afdf51bb69de802f6d45656b46900e3

Request headers

Referer
http://update.buh.by/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 08:35:29 GMT
last-modified
Wed, 04 Nov 2015 13:25:54 GMT
server
nginx
access-control-allow-origin
*
etag
"563a0762-7fa"
content-type
image/gif
status
200
cache-control
max-age=604800
accept-ranges
bytes
content-length
2042
expires
Mon, 03 Feb 2020 08:35:29 GMT

Redirect headers

status
301
date
Mon, 27 Jan 2020 08:35:29 GMT
server
nginx
content-length
178
location
https://tam.by/images/catalog-tut.gif
content-type
text/html
counter
top-fwz1.mail.ru/
Redirect Chain
  • http://top-fwz1.mail.ru/counter?id=942103;t=479;l=1
  • https://top-fwz1.mail.ru/counter?id=942103;t=479;l=1
2 KB
3 KB
Image
General
Full URL
https://top-fwz1.mail.ru/counter?id=942103;t=479;l=1
Requested by
Host: update.buh.by
URL: http://update.buh.by/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, CHACHA20_POLY1305
Server
217.69.133.145 , Russian Federation, ASN47764 (MAILRU-AS Mail.Ru, RU),
Reverse DNS
top-fwz1.mail.ru
Software
nginx /
Resource Hash
ee1c56e21f2741f19de9351f363ff0cf5bdb7aed3e29720716f9aecc1268055e
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://update.buh.by/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Mon, 27 Jan 2020 08:35:29 GMT
X-Content-Type-Options
nosniff
P3P
CP="NOI DSP COR NID CUR PSA OUR NOR"
Connection
keep-alive
Content-Length
2513
Pragma
no-cache
AMP-Access-Control-Allow-Source-Origin
*
Server
nginx
Access-Control-Allow-Methods
GET, POST, HEAD, PUT, OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
AMP-Access-Control-Allow-Source-Origin
Cache-control
private, no-cache, no-store, max-age=0
Access-Control-Allow-Credentials
true
Timing-Allow-Origin
*
Keep-Alive
timeout=60

Redirect headers

Date
Mon, 27 Jan 2020 08:35:28 GMT
X-Content-Type-Options
nosniff
P3P
CP="NOI DSP COR NID CUR PSA OUR NOR"
Connection
keep-alive
Content-Length
0
Pragma
no-cache
AMP-Access-Control-Allow-Source-Origin
*
Server
nginx
Location
https://top-fwz1.mail.ru/counter?id=942103;t=479;l=1
Access-Control-Allow-Methods
GET, POST, HEAD, PUT, OPTIONS
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
AMP-Access-Control-Allow-Source-Origin
Cache-control
private, no-cache, no-store, max-age=0
Access-Control-Allow-Credentials
true
Timing-Allow-Origin
*
Keep-Alive
timeout=60
code.js
top-fwz1.mail.ru/js/
16 KB
7 KB
Script
General
Full URL
http://top-fwz1.mail.ru/js/code.js
Requested by
Host: update.buh.by
URL: http://update.buh.by/
Protocol
HTTP/1.1
Server
217.69.133.145 , Russian Federation, ASN47764 (MAILRU-AS Mail.Ru, RU),
Reverse DNS
top-fwz1.mail.ru
Software
nginx /
Resource Hash
6ea507220aecf7cc439f1cd091a2ff4ceeb9eee6992e20c9d0d7e4eb3771bc25
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://update.buh.by/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Mon, 27 Jan 2020 08:35:29 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Transfer-Encoding
chunked
P3P
CP="NOI DSP COR NID CUR PSA OUR NOR"
Connection
keep-alive
AMP-Access-Control-Allow-Source-Origin
*
Last-Modified
Mon, 16 Dec 2019 11:54:30 GMT
Server
nginx
ETag
W/"5df77076-404f"
Access-Control-Allow-Methods
GET, POST, HEAD, PUT, OPTIONS
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
AMP-Access-Control-Allow-Source-Origin
Cache-control
max-age=7200, private
Access-Control-Allow-Credentials
true
Timing-Allow-Origin
*
Keep-Alive
timeout=60
abmw.asp
bm2017.jukola.info/ Frame 4A05
0
0

counter
top-fwz1.mail.ru/
43 B
953 B
Other
General
Full URL
https://top-fwz1.mail.ru/counter?js=13;id=942103;u=http%3A//update.buh.by/;st=1580114128962;title=%D0%90%D0%B2%D1%82%D0%BE%D0%BC%D0%B0%D1%82%D0%B8%D1%87%D0%B5%D1%81%D0%BA%D0%B8%D0%B9%20%D0%B7%D0%B0%D0%BA%D0%B0%D0%B7%20%D0%BE%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F%20%D0%BD%D0%B0%D1%81%D1%82%D1%80%D0%BE%D0%B5%D0%BA%201%D0%A1%20%D0%BE%D1%82%20%D0%BA%D0%BE%D0%BC%D0%BF%D0%B0%D0%BD%D0%B8%D0%B8%20%22%D0%AE%D0%9A%D0%9E%D0%9B%D0%90-%D0%98%D0%9D%D0%A4%D0%9E%22;s=1600*1200;vp=1585*1221;touch=0;hds=1;flash=;sid=6276636f55b932d4;ver=60.1.0;tz=-60%2FEurope%2FBerlin;ni=10//4g/0/0/;lvid=1580114129113%3A1580114129145%3A1%3A2f65d4648ec78cf4ccb8c4f1b54904cc;_=0.608426524047408
Requested by
Host: top-fwz1.mail.ru
URL: http://top-fwz1.mail.ru/js/code.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, CHACHA20_POLY1305
Server
217.69.133.145 , Russian Federation, ASN47764 (MAILRU-AS Mail.Ru, RU),
Reverse DNS
top-fwz1.mail.ru
Software
nginx /
Resource Hash
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://update.buh.by/
Origin
http://update.buh.by
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Date
Mon, 27 Jan 2020 08:35:29 GMT
X-Content-Type-Options
nosniff
P3P
CP="NOI DSP COR NID CUR PSA OUR NOR"
Connection
keep-alive
Content-Length
43
Pragma
no-cache
AMP-Access-Control-Allow-Source-Origin
http://update.buh.by
Server
nginx
Access-Control-Allow-Methods
GET, POST, HEAD, PUT, OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
http://update.buh.by
Access-Control-Expose-Headers
AMP-Access-Control-Allow-Source-Origin
Cache-control
private, no-cache, no-store, max-age=0
Access-Control-Allow-Credentials
true
Timing-Allow-Origin
http://update.buh.by
Keep-Alive
timeout=60
tracker
top-fwz1.mail.ru/
43 B
838 B
Other
General
Full URL
https://top-fwz1.mail.ru/tracker?js=13;id=942103;u=http%3A//update.buh.by/;st=1580114128962;s=1600*1200;vp=1585*1221;touch=0;hds=1;flash=;sid=6276636f55b932d4;ver=60.1.0;tz=-60%2FEurope%2FBerlin;nt=0/0/1580114128001/////522/524/577/577/598//598/751/753/758/961/961/961/1524/1524/;ni=10//4g/0/0/;lvid=1580114129113%3A1580114129528%3A2%3A2f65d4648ec78cf4ccb8c4f1b54904cc;_=0.038804215016876586;e=RT/load;et=1580114129526
Requested by
Host: top-fwz1.mail.ru
URL: http://top-fwz1.mail.ru/js/code.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, CHACHA20_POLY1305
Server
217.69.133.145 , Russian Federation, ASN47764 (MAILRU-AS Mail.Ru, RU),
Reverse DNS
top-fwz1.mail.ru
Software
nginx /
Resource Hash
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://update.buh.by/
Origin
http://update.buh.by
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Date
Mon, 27 Jan 2020 08:35:29 GMT
X-Content-Type-Options
nosniff
P3P
CP="NOI DSP COR NID CUR PSA OUR NOR"
Connection
keep-alive
Content-Length
43
Pragma
no-cache
AMP-Access-Control-Allow-Source-Origin
http://update.buh.by
Server
nginx
Access-Control-Allow-Methods
GET, POST, HEAD, PUT, OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
http://update.buh.by
Access-Control-Expose-Headers
AMP-Access-Control-Allow-Source-Origin
Cache-control
private, no-cache, no-store, max-age=0
Access-Control-Allow-Credentials
true
Timing-Allow-Origin
http://update.buh.by
Keep-Alive
timeout=60

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
bm2017.jukola.info
URL
https://bm2017.jukola.info/abmw.asp?z=7&isframe=true&autorotate=true

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| _tmr

4 Cookies

Domain/Path Name / Value
.buh.by/ Name: tmr_reqNum
Value: 2
.buh.by/ Name: tmr_lvidTS
Value: 1580114129113
.buh.by/ Name: tmr_lvid
Value: 2f65d4648ec78cf4ccb8c4f1b54904cc
update.buh.by/ Name: ASPSESSIONIDQSRDDSAS
Value: FHGNKEDDILNLBFNAEENHLKGD