Submitted URL: http://shell.acceptpending.info/pl/dermatitis.php
Effective URL: https://gallaryd.com/
Submission: On March 27 via api from BE — Scanned from DE

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 3 HTTP transactions. The main IP is 212.37.105.25, located in Asenhoga, Sweden and belongs to VARNAMO-ENERGI, SE. The main domain is gallaryd.com.
TLS certificate: Issued by R3 on March 10th 2023. Valid for: 3 months.
This is the only time gallaryd.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 185.193.89.7 210950 (ERISHENNY...)
1 212.37.105.25 31642 (VARNAMO-E...)
3 2
Apex Domain
Subdomains
Transfer
2 acceptpending.info
shell.acceptpending.info
3 KB
1 gallaryd.com
gallaryd.com
641 B
3 2
Domain Requested by
2 shell.acceptpending.info shell.acceptpending.info
1 gallaryd.com
3 2

This site contains links to these domains. Also see Links.

Domain
nginx.org
nginx.com
Subject Issuer Validity Valid
sdsab.se
R3
2023-03-10 -
2023-06-08
3 months crt.sh

This page contains 1 frames:

Primary Page: https://gallaryd.com/
Frame ID: E6F976DF1C153FE4147FD94FCCA2192D
Requests: 3 HTTP requests in this frame

Screenshot

Page Title

Welcome to nginx!

Page URL History Show full URLs

  1. http://shell.acceptpending.info/pl/dermatitis.php Page URL
  2. http://shell.acceptpending.info/pl/dermatitis.php Page URL
  3. https://gallaryd.com/ Page URL

Page Statistics

3
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

4 kB
Transfer

8 kB
Size

6
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://shell.acceptpending.info/pl/dermatitis.php Page URL
  2. http://shell.acceptpending.info/pl/dermatitis.php Page URL
  3. https://gallaryd.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
dermatitis.php
shell.acceptpending.info/pl/
4 KB
2 KB
Document
General
Full URL
http://shell.acceptpending.info/pl/dermatitis.php
Protocol
HTTP/1.1
Server
185.193.89.7 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
0287af4d0e4600e329d0c4c578b57ddd60bd5a6b871523ea89274d3087c94c79

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
keep-alive
Content-Encoding
gzip
Content-Length
1521
Content-Type
text/html; charset=UTF-8
Date
Mon, 27 Mar 2023 18:48:07 GMT
Server
nginx/1.14.2
Vary
Accept-Encoding
dermatitis.php
shell.acceptpending.info/pl/
4 KB
2 KB
Document
General
Full URL
http://shell.acceptpending.info/pl/dermatitis.php
Requested by
Host: shell.acceptpending.info
URL: http://shell.acceptpending.info/pl/dermatitis.php
Protocol
HTTP/1.1
Server
185.193.89.7 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
b99fafaf82d4aecc1ac0e5efb137b11baaa99ef1456176643599ce8f977f1543

Request headers

Referer
http://shell.acceptpending.info/pl/dermatitis.php
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
keep-alive
Content-Encoding
gzip
Content-Length
1546
Content-Type
text/html; charset=UTF-8
Date
Mon, 27 Mar 2023 18:48:07 GMT
Server
nginx/1.14.2
Vary
Accept-Encoding
Primary Request /
gallaryd.com/
612 B
641 B
Document
General
Full URL
https://gallaryd.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
212.37.105.25 Asenhoga, Sweden, ASN31642 (VARNAMO-ENERGI, SE),
Reverse DNS
m.sdsab.se
Software
nginx/1.19.6 /
Resource Hash
38ffd4972ae513a0c79a8be4573403edcd709f0f572105362b08ff50cf6de521

Request headers

Referer
http://shell.acceptpending.info/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
gzip
content-type
text/html
date
Mon, 27 Mar 2023 18:48:08 GMT
etag
W/"5fd8c14a-264"
last-modified
Tue, 15 Dec 2020 13:59:38 GMT
server
nginx/1.19.6
transfer-encoding
chunked
vary
Accept-Encoding

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless

6 Cookies

Domain/Path Name / Value
shell.acceptpending.info/ Name: d
Value: 0
shell.acceptpending.info/ Name: n
Value: Etc/Unknown
shell.acceptpending.info/ Name: sp
Value: Win32
shell.acceptpending.info/ Name: su
Value: Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/111.0.5563.110%20Safari/537.36
shell.acceptpending.info/ Name: iu
Value: Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/111.0.5563.110%20Safari/537.36
shell.acceptpending.info/ Name: wd
Value: false

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

gallaryd.com
shell.acceptpending.info
185.193.89.7
212.37.105.25
0287af4d0e4600e329d0c4c578b57ddd60bd5a6b871523ea89274d3087c94c79
38ffd4972ae513a0c79a8be4573403edcd709f0f572105362b08ff50cf6de521
b99fafaf82d4aecc1ac0e5efb137b11baaa99ef1456176643599ce8f977f1543