mariatrips.com Open in urlscan Pro
86.104.211.30 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://mariatrips.com/wp-content/plugins/aakismet/n.php
Submission: On April 27 via manual (April 27th 2022, 8:50:23 am UTC) from RO — Scanned from DE

Summary HTTP 7 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 5 IPs in 4 countries across 5 domains to perform 7 HTTP transactions. The main IP is 86.104.211.30, located in Romania and belongs to NIXWAY-SRL, RO. The main domain is mariatrips.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on March 22nd 2022. Valid for: 3 months.

This is the only time mariatrips.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
1	86.104.211.30 86.104.211.30		47915 (NIXWAY-SRL) (NIXWAY-SRL)
2	2606:4700::68... 2606:4700::6810:5714		13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6812:1734		13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	74.120.188.194 74.120.188.194		22300 (WIKIA) (WIKIA)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:2a		20446 (STACKPATH...) (STACKPATH-CDN)
7	5

1 86.104.211.30 (Romania)

ASN47915 (NIXWAY-SRL, RO)
PTR: ns3.activedesign.ro

mariatrips.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:5714 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:1734 (United States)

ASN13335 (CLOUDFLARENET, US)

pro.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.120.188.194 (Frankfurt am Main, Germany)

ASN22300 (WIKIA, US)

static.wikia.nocookie.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:2a (Netherlands)

ASN20446 (STACKPATH-CDN, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	fontawesome.com pro.fontawesome.com — Cisco Umbrella Rank: 4754	150 KB
2	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 437	48 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 610	30 KB
1	nocookie.net static.wikia.nocookie.net — Cisco Umbrella Rank: 6530	866 B
1	mariatrips.com mariatrips.com	332 KB
7	5

	Domain	Requested by
2	pro.fontawesome.com	mariatrips.com pro.fontawesome.com
2	cdn.jsdelivr.net	mariatrips.com
1	code.jquery.com	mariatrips.com
1	static.wikia.nocookie.net	mariatrips.com
1	mariatrips.com
7	5

This site contains no links.

Subject Issuer	Validity	Valid
mariatrips.com cPanel, Inc. Certification Authority	`2022-03-22` - `2022-06-20`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-03` - `2022-07-02`	a year	crt.sh
*.fontawesome.com DigiCert TLS RSA SHA256 2020 CA1	`2021-12-01` - `2023-01-01`	a year	crt.sh
*.wikia.nocookie.net DigiCert TLS RSA SHA256 2020 CA1	`2022-01-26` - `2023-02-26`	a year	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://mariatrips.com/wp-content/plugins/aakismet/n.php
Frame ID: 73C33FFC53AA4795BB25341E0A3A7C74
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Negat1ve Shell

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

7
Requests

100 %
HTTPS

60 %
IPv6

5
Domains

5
Subdomains

5
IPs

4
Countries

561 kB
Transfer

920 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request n.php Show response
mariatrips.com/wp-content/plugins/aakismet/ 331 KB
332 KB 365ms
287ms Document
text/html 86.104.211.30
NIXWAY-SRL

General

Check archive.org

Show headers Download Go to

Full URL: https://mariatrips.com/wp-content/plugins/aakismet/n.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 86.104.211.30 , Romania, ASN47915 (NIXWAY-SRL, RO),
Reverse DNS: ns3.activedesign.ro
Software: Apache /
Resource Hash: 0b7751e3e790e13bed33b588c0f0053e1583e11a9de4ef8aea19a5d34d5a0b38

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Wed, 27 Apr 2022 08:50:16 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive: timeout=5, max=100
Pragma: no-cache
Server: Apache
Transfer-Encoding: chunked

GET
H2 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.0.1/dist/css/ 152 KB
24 KB 42ms
21ms Stylesheet
text/css 2606:4700::6810:5714
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@5.0.1/dist/css/bootstrap.min.css

Requested by

Host: mariatrips.com
URL: https://mariatrips.com/wp-content/plugins/aakismet/n.php

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5714 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

847280dddfc7b6d0bc396dd2974f775bc0e866e7611c90e3fbe919628e8c2f30

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://mariatrips.com/
Origin: https://mariatrips.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Wed, 27 Apr 2022 08:50:16 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 3194914
x-jsd-version: 5.0.1
x-cache: HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19137-FRA
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"25fef-PDndyutgvrSms9Gt5O+JOaWK1Zo"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8mMnh2hS%2F9B9gekrB6ruOgr%2BGpiBX%2FXqzs%2B4alcrjKoSGpRWrL5PYyTci5U1s9dhFQbbKh739L3SW5%2FoLSTR80%2BfDN4Qd3lmm9yBkW8JBn7t7mcLT1jpv4JxV4%2Bv3zVKVmaSI40aHeTtjEsLGks%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cf-ray: 70264f474a0d9b31-FRA

GET
H2 200 all.css
pro.fontawesome.com/releases/v5.10.0/css/ 153 KB
29 KB 69ms
41ms Stylesheet
text/css 2606:4700::6812:1734
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pro.fontawesome.com/releases/v5.10.0/css/all.css
Requested by: Host: mariatrips.com
URL: https://mariatrips.com/wp-content/plugins/aakismet/n.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1734 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2af905d92cfd34b5413126a54f639da408166cbbcb54318e413ad5e10b5bf6ec

Request headers

Referer: https://mariatrips.com/
Origin: https://mariatrips.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Wed, 27 Apr 2022 08:50:16 GMT
content-encoding: gzip
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
cf-cache-status: HIT
age: 20
x-amz-request-id: AT1MRFVKE0FB7R78
x-amz-id-2: fBcvGYOD7bzzJVR72nG+pvzoOvYtTgoz2FEpgF61mF9f2o+m2DXXjuDEqMpgH4e9z9U/80W4SnE=
last-modified: Mon, 28 Jun 2021 16:54:32 GMT
server: cloudflare
etag: W/"aa1272633e7e552395d147a499bad186"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
cf-ray: 70264f475dcd8fe6-FRA

GET
H2 404 Pacman2.jpg
static.wikia.nocookie.net/central/images/1/12/ 346 B
866 B 40ms
8ms Image
image/webp 74.120.188.194
WIKIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.wikia.nocookie.net/central/images/1/12/Pacman2.jpg
Requested by: Host: mariatrips.com
URL: https://mariatrips.com/wp-content/plugins/aakismet/n.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 74.120.188.194 Frankfurt am Main, Germany, ASN22300 (WIKIA, US),
Reverse DNS
Software: /
Resource Hash: d73e11c3dc87c0e51852e1e087b0de8de0d629083f02ca982fd5b8a3bc3270c8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mariatrips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Wed, 27 Apr 2022 08:07:25 GMT
x-cacheable: YES - FORCED
age: 2570
x-cache: ORIGIN, HIT, MISS
x-envoy-upstream-service-time: 132
content-disposition: inline; filename="broken-image.webp"; filename*=UTF-8''broken-image.webp
content-length: 346
x-served-by: thumblr-75cb74c6c9-5f9v5, wk-cdn-f4, wk-cdn-f1
surrogate-key: c569ef501167fa4d3ce9ce4c6824705b5820ac15 wiki-central thumblr scale-to-width
x-thumbnailer: Thumblr
etag: CMTuhPC4wfUCEAE=
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=3600
timing-allow-origin: *
x-cache-hits: ORIGIN, 4, 0

GET
H2 200 fa-solid-900.woff2
pro.fontawesome.com/releases/v5.10.0/webfonts/ 120 KB
120 KB 19ms
19ms Font
font/woff2 2606:4700::6812:1734
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pro.fontawesome.com/releases/v5.10.0/webfonts/fa-solid-900.woff2
Requested by: Host: pro.fontawesome.com
URL: https://pro.fontawesome.com/releases/v5.10.0/css/all.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1734 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d27aa8bf9677cf4ef12acd7b37afc20f1f661d7c163b929ae9caf103b01fce37

Request headers

Referer: https://pro.fontawesome.com/releases/v5.10.0/css/all.css
Origin: https://mariatrips.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Wed, 27 Apr 2022 08:50:16 GMT
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
cf-cache-status: HIT
age: 20
cf-ray: 70264f47be5b8fe6-FRA
content-length: 123004
x-amz-id-2: xN657d1B0mS5QkamvvlizpyFg5F5QaVdvyBxMaAvQvD1wYxWytVLGuK8UjwRI4fbHThe243BU90=
last-modified: Mon, 28 Jun 2021 16:56:06 GMT
server: cloudflare
etag: "88fd444847dc842d15e229df26571b03"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-request-id: AT1RQJN7SV9VTHZW
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
content-type: font/woff2

GET
H2 200 bootstrap.bundle.min.js Show response
cdn.jsdelivr.net/npm/bootstrap@5.0.1/dist/js/ 77 KB
23 KB 17ms
17ms Script
application/javascript 2606:4700::6810:5714
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@5.0.1/dist/js/bootstrap.bundle.min.js

Requested by

Host: mariatrips.com
URL: https://mariatrips.com/wp-content/plugins/aakismet/n.php

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5714 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

79d443b15f542c8a8acca8e937f2a3c90ecba78bd49fdbac6c9b878c7f1293e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://mariatrips.com/
Origin: https://mariatrips.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Wed, 27 Apr 2022 08:50:16 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 3194915
x-jsd-version: 5.0.1
x-cache: HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19171-FRA
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"1339c-XbTEDbxr09liPumKIGHdJliFzy4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qpLSU2so9QVNXsGBvpBXw3btUd1Rnlb7%2BjDunyGGXzGNAPv3rVnZGkG7ydMu3Z4IaOwxK5ZwcTKUszEnOQpVAKeiFECXLXAeAdoLW06R8PdDVoqs15lh0sU%2F1MVBmK3n3hROrqPY63JR0iSXVlE%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cf-ray: 70264f47fb619b31-FRA

GET
H2 200 jquery-3.6.0.min.js Show response
code.jquery.com/ 87 KB
30 KB 38ms
16ms Script
application/javascript 2001:4de0:ac18::1:a:2a
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.6.0.min.js
Requested by: Host: mariatrips.com
URL: https://mariatrips.com/wp-content/plugins/aakismet/n.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:2a , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: nginx /
Resource Hash: ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

Referer: https://mariatrips.com/
Origin: https://mariatrips.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Wed, 27 Apr 2022 08:50:16 GMT
content-encoding: gzip
last-modified: Fri, 20 Aug 2021 17:47:53 GMT
server: nginx
etag: W/"611feac9-15d9d"
vary: Accept-Encoding
x-hw: 1651049416.dop137.fr8.t,1651049416.cds201.fr8.hn,1651049416.cds144.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30875

Verdicts & Comments Add Verdict or Comment

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored function| getScreenDetails number| uidEvent object| bootstrap function| $ function| jQuery object| renameModal object| deleteModal object| viewModal object| downloadModal

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			mariatrips.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: ob4lcl6ad8vvub8n5mds8re0m7

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://static.wikia.nocookie.net/central/images/1/12/Pacman2.jpg Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
code.jquery.com
mariatrips.com
pro.fontawesome.com
static.wikia.nocookie.net
2001:4de0:ac18::1:a:2a
2606:4700::6810:5714
2606:4700::6812:1734
74.120.188.194
86.104.211.30
0b7751e3e790e13bed33b588c0f0053e1583e11a9de4ef8aea19a5d34d5a0b38
2af905d92cfd34b5413126a54f639da408166cbbcb54318e413ad5e10b5bf6ec
79d443b15f542c8a8acca8e937f2a3c90ecba78bd49fdbac6c9b878c7f1293e9
847280dddfc7b6d0bc396dd2974f775bc0e866e7611c90e3fbe919628e8c2f30
d27aa8bf9677cf4ef12acd7b37afc20f1f661d7c163b929ae9caf103b01fce37
d73e11c3dc87c0e51852e1e087b0de8de0d629083f02ca982fd5b8a3bc3270c8
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e