Submitted URL: http://www.khatawat.it/link_out.asp?url=https://u.to/ALyMFQ
Effective URL: http://pizzaexpressbc.ca/ultimatebb/alternatads/advertisers/archive2/artikkel/showcase/iisstart/_functions/feedback.php/n...
Submission: On June 12 via manual from IN

Summary

This website contacted 4 IPs in 3 countries across 5 domains to perform 4 HTTP transactions. The main IP is 2607:f1c0:100f:f000::209, located in United States and belongs to ONEANDONE-AS Brauerstrasse 48, DE. The main domain is pizzaexpressbc.ca.
This is the only time pizzaexpressbc.ca was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 31.11.33.169 31034 (ARUBA-ASN)
1 195.216.243.155 29226 (MASTERTEL...)
1 2a02:6b8::1:119 13238 (YANDEX)
1 2607:f1c0:100... 8560 (ONEANDONE...)
4 4
Apex Domain
Subdomains
Transfer
1 pizzaexpressbc.ca
pizzaexpressbc.ca
3 KB
1 yandex.ru
mc.yandex.ru
89 KB
1 u.to
u.to
1 KB
1 khatawat.it
www.khatawat.it
317 B
0 yadro.ru Failed
counter.yadro.ru Failed
4 5
Domain Requested by
1 pizzaexpressbc.ca u.to
1 mc.yandex.ru u.to
1 u.to
1 www.khatawat.it 1 redirects
0 counter.yadro.ru Failed
4 5

This site contains no links.

Subject Issuer Validity Valid
u.to
COMODO RSA Domain Validation Secure Server CA
2018-09-18 -
2019-09-18
a year crt.sh
bs.yandex.ru
Yandex CA
2018-10-03 -
2019-10-03
a year crt.sh

This page contains 1 frames:

Primary Page: http://pizzaexpressbc.ca/ultimatebb/alternatads/advertisers/archive2/artikkel/showcase/iisstart/_functions/feedback.php/ngwe/zhamw/?pull=yephkx1g01qb10uz
Frame ID: 38B9EC269A3D852FBE80FC02C2018018
Requests: 4 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://www.khatawat.it/link_out.asp?url=https://u.to/ALyMFQ HTTP 302
    https://u.to/ALyMFQ Page URL
  2. http://pizzaexpressbc.ca/ultimatebb/alternatads/advertisers/archive2/artikkel/showcase/iisstart/_func... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

4
Requests

50 %
HTTPS

50 %
IPv6

5
Domains

5
Subdomains

4
IPs

3
Countries

93 kB
Transfer

351 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://www.khatawat.it/link_out.asp?url=https://u.to/ALyMFQ HTTP 302
    https://u.to/ALyMFQ Page URL
  2. http://pizzaexpressbc.ca/ultimatebb/alternatads/advertisers/archive2/artikkel/showcase/iisstart/_functions/feedback.php/ngwe/zhamw/?pull=yephkx1g01qb10uz Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://www.khatawat.it/link_out.asp?url=https://u.to/ALyMFQ HTTP 302
  • https://u.to/ALyMFQ

4 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Cookie set ALyMFQ
u.to/
Redirect Chain
  • http://www.khatawat.it/link_out.asp?url=https://u.to/ALyMFQ
  • https://u.to/ALyMFQ
1 KB
1 KB
Document
General
Full URL
https://u.to/ALyMFQ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
195.216.243.155 Moscow, Russian Federation, ASN29226 (MASTERTEL-AS Moscow, Russia, RU),
Reverse DNS
s5.unet.com
Software
nginx/1.8.0 /
Resource Hash

Request headers

Host
u.to
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Server
nginx/1.8.0
Date
Wed, 12 Jun 2019 14:01:47 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Keep-Alive
timeout=15
Set-Cookie
lng=en; path=/; expires=Thu, 11-Jun-2020 14:01:47 GMT; domain=.u.to;
Cache-Control
no-cache no-store
Pragma
no-cache
Vary
host
Content-Encoding
gzip

Redirect headers

Cache-Control
private
Content-Type
text/html
Location
https://u.to/ALyMFQ
Server
Microsoft-IIS/8.5
Referer
http://www.khatawat.it
Set-Cookie
ASPSESSIONIDSQCCARAR=OKDMPHEAPDLJDFGHFEHDHAJP; path=/
X-Powered-By
ASP.NET
Date
Wed, 12 Jun 2019 14:01:44 GMT
Content-Length
140
tag.js
mc.yandex.ru/metrika/
345 KB
89 KB
Script
General
Full URL
https://mc.yandex.ru/metrika/tag.js
Requested by
Host: u.to
URL: https://u.to/ALyMFQ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx/1.12.2 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://u.to/ALyMFQ
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 12 Jun 2019 14:01:46 GMT
Content-Encoding
br
Last-Modified
Tue, 11 Jun 2019 10:37:04 GMT
Server
nginx/1.12.2
ETag
"5cff8450-163e3"
Strict-Transport-Security
max-age=31536000
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600
Connection
keep-alive
Content-Length
91107
Expires
Wed, 12 Jun 2019 15:01:46 GMT
hit;utostat
counter.yadro.ru/
0
0

Primary Request /
pizzaexpressbc.ca/ultimatebb/alternatads/advertisers/archive2/artikkel/showcase/iisstart/_functions/feedback.php/ngwe/zhamw/
5 KB
3 KB
Document
General
Full URL
http://pizzaexpressbc.ca/ultimatebb/alternatads/advertisers/archive2/artikkel/showcase/iisstart/_functions/feedback.php/ngwe/zhamw/?pull=yephkx1g01qb10uz
Requested by
Host: u.to
URL: https://u.to/ALyMFQ
Protocol
HTTP/1.1
Server
2607:f1c0:100f:f000::209 , United States, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache / PHP/7.0.33
Resource Hash
bc7647d3347260eebd6ae787eaaff8223ac5f62ba0e0d81843f46da93ac27259

Request headers

Host
pizzaexpressbc.ca
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Keep-Alive
timeout=15
Date
Wed, 12 Jun 2019 14:01:47 GMT
Server
Apache
X-Powered-By
PHP/7.0.33
Content-Encoding
gzip

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
counter.yadro.ru
URL
https://counter.yadro.ru/hit;utostat?r;s1600*1200*24;uhttps%3A//u.to/ALyMFQ;1560348106506

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

counter.yadro.ru
mc.yandex.ru
pizzaexpressbc.ca
u.to
www.khatawat.it
counter.yadro.ru
195.216.243.155
2607:f1c0:100f:f000::209
2a02:6b8::1:119
31.11.33.169
bc7647d3347260eebd6ae787eaaff8223ac5f62ba0e0d81843f46da93ac27259