Submitted URL: https://nts.embluemail.com/p/cl?data=xeN2zmLAdKsJjNJSxxNKVNCZ%2FcaH9xo9YolNHffBn3aswbcAFcpIJPcyGlZpg%2BpajNSoMD7Lf9jxUak5G2...
Effective URL: https://qjvj.garantidyned.com///?i0mee
Submission: On December 10 via manual from US — Scanned from DE

Summary

This website contacted 1 IPs in 2 countries across 2 domains to perform 1 HTTP transactions. The main IP is 213.238.183.80, located in Turkey and belongs to . The main domain is qjvj.garantidyned.com.
TLS certificate: Issued by R3 on October 15th 2022. Valid for: 3 months.
This is the only time qjvj.garantidyned.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 54.94.233.82 16509 (AMAZON-02)
1 213.238.183.80 ()
1 1
Apex Domain
Subdomains
Transfer
1 garantidyned.com
qjvj.garantidyned.com
2 KB
1 embluemail.com
nts.embluemail.com — Cisco Umbrella Rank: 139009
202 B
1 2
Domain Requested by
1 qjvj.garantidyned.com
1 nts.embluemail.com 1 redirects
1 2

This site contains no links.

Subject Issuer Validity Valid
*.garantidyned.com
R3
2022-10-15 -
2023-01-13
3 months crt.sh

This page contains 1 frames:

Primary Page: https://qjvj.garantidyned.com///?i0mee
Frame ID: 786C1B6F0326A494082911DF46495BEA
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

Loading.................

Page URL History Show full URLs

  1. https://nts.embluemail.com/p/cl?data=xeN2zmLAdKsJjNJSxxNKVNCZ%2FcaH9xo9YolNHffBn3aswbcAFcpIJPcyGlZpg%2B... HTTP 302
    https://qjvj.garantidyned.com///?i0mee Page URL

Page Statistics

1
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

2 kB
Transfer

7 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://nts.embluemail.com/p/cl?data=xeN2zmLAdKsJjNJSxxNKVNCZ%2FcaH9xo9YolNHffBn3aswbcAFcpIJPcyGlZpg%2BpajNSoMD7Lf9jxUak5G2JJdhyGiSugSfvKJm%2BjWjtLkAU%3D!-!8e4el7a!-!https://qjvj.garantidyned.com///?i0mee HTTP 302
    https://qjvj.garantidyned.com///?i0mee Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

1 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
qjvj.garantidyned.com///
Redirect Chain
  • https://nts.embluemail.com/p/cl?data=xeN2zmLAdKsJjNJSxxNKVNCZ%2FcaH9xo9YolNHffBn3aswbcAFcpIJPcyGlZpg%2BpajNSoMD7Lf9jxUak5G2JJdhyGiSugSfvKJm%2BjWjtLkAU%3D!-!8e4el7a!-!https://qjvj.garantidyned.com//...
  • https://qjvj.garantidyned.com///?i0mee
7 KB
2 KB
Document
General
Full URL
https://qjvj.garantidyned.com///?i0mee
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
213.238.183.80 , Turkey, ASN (),
Reverse DNS
80.183.238.213.static.cenuta.com
Software
LiteSpeed / PHP/7.4.29
Resource Hash
1ddb335da109a3672523a207c7bae529349f97cd9aabd30dcf6f3f1674866fea

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding
br
content-length
1894
content-type
text/html; charset=UTF-8
date
Sat, 10 Dec 2022 11:48:28 GMT
server
LiteSpeed
vary
Accept-Encoding
x-powered-by
PHP/7.4.29

Redirect headers

content-length
0
content-type
application/json
date
Sat, 10 Dec 2022 11:48:27 GMT
location
https://qjvj.garantidyned.com///?i0mee
x-amz-apigw-id
c7bB2HnKGjQFYog=
x-amzn-requestid
7305722d-973a-481b-afb3-293a6da6fce1
x-amzn-trace-id
Root=1-6394720b-1b7e041c420260fc2c2db1e4;Sampled=0

Verdicts & Comments Add Verdict or Comment

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange string| domainMatching string| redirectUrl string| redirectDelimiter boolean| enablebase64 boolean| decodebase64 object| Base64 function| ValidateEmail function| Fired number| c2 number| c1 number| c3

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

nts.embluemail.com
qjvj.garantidyned.com
213.238.183.80
54.94.233.82
1ddb335da109a3672523a207c7bae529349f97cd9aabd30dcf6f3f1674866fea