89.44.198.16 - urlscan.io

Summary

This website contacted 2 IPs in 2 countries across 1 domains to perform 2 HTTP transactions. The main IP is 89.44.198.16, located in Samara, Russian Federation and belongs to GCORE, LU. The main domain is 89.44.198.16.
TLS certificate: Issued by infocheckrakutenaccountmail.xyz on August 26th 2021. Valid for: a year.

This is the only time 89.44.198.16 was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	89.44.198.16 89.44.198.16	199524 (GCORE) (GCORE)
1	2606:4700:20:... 2606:4700:20::ac43:4b7a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2

1 89.44.198.16 (Samara, Russian Federation)

ASN199524 (GCORE, LU)
PTR: ljyzzzyyvjvjjv29.example.com

89.44.198.16	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::ac43:4b7a (United States)

ASN13335 (CLOUDFLARENET, US)

www.lyfemarketing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	lyfemarketing.com www.lyfemarketing.com	60 KB
2	1

	Domain	Requested by
1	www.lyfemarketing.com	89.44.198.16
2	1

This site contains no links.

Subject Issuer	Validity	Valid
infocheckrakutenaccountmail.xyz infocheckrakutenaccountmail.xyz	`2021-08-26` - `2022-08-26`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-07` - `2022-07-06`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://89.44.198.16/
Frame ID: DE9132612061B3AA102DA3169F46B4DB
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Welcome to ramuel.com Ultimate Email Marketing Solution

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /php\/?([\d.]+)?/i

CentOS (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /CentOS/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

2
Requests

50 %
HTTPS

50 %
IPv6

1
Domains

1
Subdomains

2
IPs

2
Countries

61 kB
Transfer

60 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
89.44.198.16/ 633 B
963 B 313ms
78ms Document
text/html 89.44.198.16
GCORE

General

Check archive.org

Show headers Download Go to

Full URL: https://89.44.198.16/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 89.44.198.16 Samara, Russian Federation, ASN199524 (GCORE, LU),
Reverse DNS: ljyzzzyyvjvjjv29.example.com
Software: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.2.34 /
Resource Hash: c61d5cd64e5452b3dd41a82b9252dfe3ceece8b145bd10112eb7bef5eca4a6e5

Request headers

Host: 89.44.198.16
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Sat, 28 Aug 2021 03:09:24 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.2.34
Last-Modified: Thu, 26 Aug 2021 15:47:30 GMT
ETag: "279-5ca7848d8f20f"
Accept-Ranges: bytes
Content-Length: 633
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H2 200 email-marketing123.jpg
www.lyfemarketing.com/blog/wp-content/uploads/2018/03/ 60 KB
60 KB 35ms
15ms Image
image/jpeg 2606:4700:20::ac43:4b7a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.lyfemarketing.com/blog/wp-content/uploads/2018/03/email-marketing123.jpg

Requested by

Host: 89.44.198.16
URL: https://89.44.198.16/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4b7a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

32240e2b12dde50169ca9d83c8184d1c717bd5394b053ffa5085e078e7f4ecf8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://89.44.198.16/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 28 Aug 2021 03:09:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 349487
cf-polished: origSize=62350, status=webp_bigger
content-length: 61120
x-xss-protection: 1; mode=block
pragma: public
last-modified: Fri, 16 Mar 2018 15:06:20 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "5aabdd6c-f38e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=83%2FuYt7%2FEEYVxiijPvh%2BihPjBPhvZmS7tnKdPzln17kr%2FFO50vgMMBNpwejJ%2F%2FFGcuuaQ5O3hy6o%2FfRs8xl4Tmb862jFEI8VYxkeYqtsszWuuUpLhX0qlnx4Hc4OHi9WXQ7MdqEFx5feWfGm4qgJNgkIxA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
expires: Wed, 24 Aug 2022 02:04:37 GMT
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 685a57337e285bf1-FRA
cf-bgj: imgq:100,h2pri

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.lyfemarketing.com
2606:4700:20::ac43:4b7a
89.44.198.16
32240e2b12dde50169ca9d83c8184d1c717bd5394b053ffa5085e078e7f4ecf8
c61d5cd64e5452b3dd41a82b9252dfe3ceece8b145bd10112eb7bef5eca4a6e5

89.44.198.16 Open in urlscan Pro 89.44.198.16 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

2 Requests

50 %HTTPS

50 %IPv6

1 Domains

1 Subdomains

2 IPs

2 Countries

61 kBTransfer

60 kBSize

0 Cookies

0 Outgoing links

Redirected requests

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

0 Cookies

Indicators

89.44.198.16 Open in urlscan Pro
89.44.198.16 Public Scan

Screenshot
Live screenshot

Full Image

2
Requests

50 %
HTTPS

50 %
IPv6

1
Domains

1
Subdomains

2
IPs

2
Countries

61 kB
Transfer

60 kB
Size

0
Cookies

2 HTTP transactions
0 data transactions