urlscan.io logo urlscan.io
SecurityTrails logo

chk-3yfb1.xyz Open in urlscan Pro
2606:4700:3034::ac43:c141  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://srartincompans.updt644-serv1ce.info/
Effective URL: https://chk-3yfb1.xyz/HXFf4N/?click=5799544&flow=129&land=lukoil_new
Submission: On August 03 via manual from IN
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 2 HTTP transactions. The main IP is 2606:4700:3034::ac43:c141, located in United States and belongs to CLOUDFLARENET, US. The main domain is chk-3yfb1.xyz.
TLS certificate: Issued by R3 on July 21st 2021. Valid for: 3 months.
This is the only time chk-3yfb1.xyz was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 87.251.86.26 212461 (NEMTCOV)
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
1 2606:4700:303... 13335 (CLOUDFLAR...)
2 2
Domain Requested by
1 chk-3yfb1.xyz
1 3grbbdf647g.xyz 1 redirects
1 srartincompans.updt644-serv1ce.info
2 3

This site contains no links.

Subject Issuer Validity Valid
*.chk-3yfb1.xyz
R3		 2021-07-21 -
2021-10-19		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://chk-3yfb1.xyz/HXFf4N/?click=5799544&flow=129&land=lukoil_new
Frame ID: F29445832A56F77EBB2F614983A435F3
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://srartincompans.updt644-serv1ce.info/ Page URL
  2. https://3grbbdf647g.xyz/redirect-luko-2/?flow=129 HTTP 302
    https://chk-3yfb1.xyz/HXFf4N/?click=5799544&flow=129&land=lukoil_new Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /php\/?([\d.]+)?/i
Overall confidence: 100%
Detected patterns
  • headers server /CentOS/i
Overall confidence: 100%
Detected patterns
  • headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

2
Requests

50 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

2 kB
Transfer

1 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://srartincompans.updt644-serv1ce.info/ Page URL
  2. https://3grbbdf647g.xyz/redirect-luko-2/?flow=129 HTTP 302
    https://chk-3yfb1.xyz/HXFf4N/?click=5799544&flow=129&land=lukoil_new Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
srartincompans.updt644-serv1ce.info/ 		113 B
439 B 		Document
General
Check archive.org
Download Go to
Full URL
http://srartincompans.updt644-serv1ce.info/
Protocol
HTTP/1.1
Server
87.251.86.26 , Russian Federation, ASN212461 (NEMTCOV, RU),
Reverse DNS
scdd.ru
Software
Apache/2.4.37 (centos) OpenSSL/1.1.1g mod_fcgid/2.3.9 PHP/7.2.24 /
Resource Hash
e76a2b886efd96b681ab992c7d68cc33d5d234245044144849bdefa89fe0518c

Request headers

Host
srartincompans.updt644-serv1ce.info
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 03 Aug 2021 13:35:40 GMT
Server
Apache/2.4.37 (centos) OpenSSL/1.1.1g mod_fcgid/2.3.9 PHP/7.2.24
Last-Modified
Tue, 03 Aug 2021 08:47:25 GMT
ETag
"71-5c8a3bc2a3d4f"
Accept-Ranges
bytes
Content-Length
113
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html
Primary Request /
chk-3yfb1.xyz/HXFf4N/
Redirect Chain
  • https://3grbbdf647g.xyz/redirect-luko-2/?flow=129
  • https://chk-3yfb1.xyz/HXFf4N/?click=5799544&flow=129&land=lukoil_new
690 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://chk-3yfb1.xyz/HXFf4N/?click=5799544&flow=129&land=lukoil_new
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:c141 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
32016daae0eaad16378cdc111722f7d2bbb302b2c4510b9ce6717038ed0350f1

Request headers

:method
GET
:authority
chk-3yfb1.xyz
:scheme
https
:path
/HXFf4N/?click=5799544&flow=129&land=lukoil_new
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
http://srartincompans.updt644-serv1ce.info/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
http://srartincompans.updt644-serv1ce.info/

Response headers

date
Tue, 03 Aug 2021 13:35:42 GMT
content-type
text/plain; charset=utf-8
cache-control
no-cache, no-store, must-revalidate,post-check=0,pre-check=0
expires
0
last-modified
Tue, 03 Aug 2021 13:35:42 GMT
pragma
no-cache
set-cookie
_subid=m4vpvq17j3r;Expires=Friday, 03-Sep-2021 13:35:42 GMT;Max-Age=2678400;Path=/ 0adc3=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjEwMFwiOjE2Mjc5OTc3NDIsXCIzMTBcIjoxNjI3OTk3NzQyfSxcImNhbXBhaWduc1wiOntcIjI4XCI6MTYyNzk5Nzc0MixcIjU5XCI6MTYyNzk5Nzc0Mn0sXCJ0aW1lXCI6MTYyNzk5Nzc0Mn0ifQ.EDmF5-vmmGmuTsuLaKqzNkE0ZfXD5OpsQwDfoxIA_Xc;Expires=Tuesday, 07-Mar-2073 03:11:24 GMT;Max-Age=1628084142;Path=/
vary
Accept-Encoding
access-control-allow-origin
*
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=A4CONl1ZfXQnqradsBvRRdejFCRIMMWyvx3DXJK8%2BCxXFnwPPACXXpX4xl2YC9snAtGGGV9ZII6neirZ7mmLE8kcsBc9YH%2FXmOA3%2FjEBQ0voSNw72TxEdClk%2FQHDBLN4lt9kfYSw8uLdfVAZ"}],"group":"cf-nel","max_age":604800}
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
678fee402aca4ee0-FRA
content-encoding
br
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

Redirect headers

date
Tue, 03 Aug 2021 13:35:42 GMT
content-type
text/html; charset=utf-8
set-cookie
site22=129; expires=Wed, 04-Aug-2021 13:35:42 GMT; Max-Age=86400; path=/
location
https://chk-3yfb1.xyz/HXFf4N/?click=5799544&flow=129&land=lukoil_new
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=igjKdrTIpDE5ZwfC1RqGve3dn3NmNgYz1YJ1Tggl9neY9lp%2Bc0iP5pQzc8WN7FE5hkjH2DuZaUI6tXPsEECJ%2B1FFdC6zGN3CIfnm7rK99k%2BGkzfuyo5JWkwIJu6NTysxv2mmEXzRsLOSHiB2mM4%3D"}],"group":"cf-nel","max_age":604800}
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
678fee3f1e834e08-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated

2 Cookies

Domain/Path Name / Value
chk-3yfb1.xyz/ Name: 0adc3
Value: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjEwMFwiOjE2Mjc5OTc3NDIsXCIzMTBcIjoxNjI3OTk3NzQyfSxcImNhbXBhaWduc1wiOntcIjI4XCI6MTYyNzk5Nzc0MixcIjU5XCI6MTYyNzk5Nzc0Mn0sXCJ0aW1lXCI6MTYyNzk5Nzc0Mn0ifQ.EDmF5-vmmGmuTsuLaKqzNkE0ZfXD5OpsQwDfoxIA_Xc
chk-3yfb1.xyz/ Name: _subid
Value: m4vpvq17j3r

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3grbbdf647g.xyz
chk-3yfb1.xyz
srartincompans.updt644-serv1ce.info
2606:4700:3030::ac43:9acd
2606:4700:3034::ac43:c141
87.251.86.26
32016daae0eaad16378cdc111722f7d2bbb302b2c4510b9ce6717038ed0350f1
e76a2b886efd96b681ab992c7d68cc33d5d234245044144849bdefa89fe0518c