temp1.ctl-users.net Open in urlscan Pro
93.240.6.88 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://temp1.ctl-users.net/
Submission: On July 13 via automatic, source certstream-suspicious (July 13th 2021, 3:14:00 pm UTC)

Summary HTTP 8 Redirects Links 2 Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 93.240.6.88, located in Friedrichsdorf, Germany and belongs to DTAG Internet service provider operations, DE. The main domain is temp1.ctl-users.net.
TLS certificate: Issued by R3 on July 13th 2021. Valid for: 3 months.

This is the only time temp1.ctl-users.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
8	93.240.6.88 93.240.6.88		3320 (DTAG Inte...) (DTAG Internet service provider operations)
8	1

8 93.240.6.88 (Friedrichsdorf, Germany)

ASN3320 (DTAG Internet service provider operations, DE)
PTR: p5df00658.dip0.t-ipconnect.de

temp1.ctl-users.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	ctl-users.net temp1.ctl-users.net	43 KB
8	1

	Domain	Requested by
8	temp1.ctl-users.net	temp1.ctl-users.net
8	1

This site contains links to these domains. Also see Links.

Domain
wordpress.org
en-gb.wordpress.org

Subject Issuer	Validity	Valid
temp1.ctl-users.net R3	`2021-07-13` - `2021-10-11`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://temp1.ctl-users.net/
Frame ID: A8331C72C8C8B644BF17B1B4B693AD27
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
headers link /rel="https:\/\/api\.w\.org\/"/i

Lua (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
headers link /rel="https:\/\/api\.w\.org\/"/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
headers link /rel="https:\/\/api\.w\.org\/"/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

OpenResty (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

43 kB
Transfer

239 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://wordpress.org/
Title: A WordPress Commenter

Search URL Search Domain Scan URL

URL: https://en-gb.wordpress.org/
Title: WordPress

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response temp1.ctl-users.net/	8 KB 3 KB	324ms 105ms	Document text/html	93.240.6.88 DTAG Internet ser...
General Check archive.org Show headers Download Go to Full URL https://temp1.ctl-users.net/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 93.240.6.88 Friedrichsdorf, Germany, ASN3320 (DTAG Internet service provider operations, DE), Reverse DNS p5df00658.dip0.t-ipconnect.de Software openresty / Resource Hash `ee7d829c4bdd529066f42172f10f0484ea6fbded4228ecedc4ffcd544fb6e901` Request headers :method GET :authority temp1.ctl-users.net :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers server openresty date Tue, 13 Jul 2021 15:13:41 GMT content-type text/html; charset=UTF-8 content-length 3176 link <https://temp1.ctl-users.net/wp-json/>; rel="https://api.w.org/" vary Accept-Encoding content-encoding gzip x-served-by temp1.ctl-users.net
GET H2	200	style.min.css temp1.ctl-users.net/wp-includes/css/dist/block-library/	57 KB 9 KB	62ms 61ms	Stylesheet text/css	93.240.6.88 DTAG Internet ser...
General Check archive.org Show headers Download Go to Full URL https://temp1.ctl-users.net/wp-includes/css/dist/block-library/style.min.css?ver=5.7.2 Requested by Host: temp1.ctl-users.net URL: https://temp1.ctl-users.net/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 93.240.6.88 Friedrichsdorf, Germany, ASN3320 (DTAG Internet service provider operations, DE), Reverse DNS p5df00658.dip0.t-ipconnect.de Software openresty / Resource Hash `2cd9de3dd26246204749cff259bc34e8e6a47ae5d6e4528b9b28c75d68d50cde` Request headers :path /wp-includes/css/dist/block-library/style.min.css?ver=5.7.2 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,/;q=0.1 cache-control no-cache sec-fetch-dest style :authority temp1.ctl-users.net referer https://temp1.ctl-users.net/ :scheme https sec-fetch-site same-origin :method GET Referer https://temp1.ctl-users.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 13 Jul 2021 15:13:41 GMT content-encoding gzip last-modified Tue, 13 Jul 2021 14:59:47 GMT server openresty etag "e33b-5c7027d2b1c76-gzip" vary Accept-Encoding content-type text/css accept-ranges bytes content-length 8685 x-served-by temp1.ctl-users.net
GET H2	200	theme.min.css temp1.ctl-users.net/wp-includes/css/dist/block-library/	3 KB 947 B	60ms 59ms	Stylesheet text/css	93.240.6.88 DTAG Internet ser...
General Check archive.org Show headers Download Go to Full URL https://temp1.ctl-users.net/wp-includes/css/dist/block-library/theme.min.css?ver=5.7.2 Requested by Host: temp1.ctl-users.net URL: https://temp1.ctl-users.net/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 93.240.6.88 Friedrichsdorf, Germany, ASN3320 (DTAG Internet service provider operations, DE), Reverse DNS p5df00658.dip0.t-ipconnect.de Software openresty / Resource Hash `3ee638689e343730a82027d03714f274b6c665cf7e3bf60b5208a3a0cdb3581d` Request headers :path /wp-includes/css/dist/block-library/theme.min.css?ver=5.7.2 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,/;q=0.1 cache-control no-cache sec-fetch-dest style :authority temp1.ctl-users.net referer https://temp1.ctl-users.net/ :scheme https sec-fetch-site same-origin :method GET Referer https://temp1.ctl-users.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 13 Jul 2021 15:13:41 GMT content-encoding gzip last-modified Tue, 13 Jul 2021 14:59:47 GMT server openresty etag "a9a-5c7027d2b1c76-gzip" vary Accept-Encoding content-type text/css accept-ranges bytes content-length 748 x-served-by temp1.ctl-users.net
GET H2	200	style.css temp1.ctl-users.net/wp-content/themes/twentytwentyone/	152 KB 22 KB	96ms 95ms	Stylesheet text/css	93.240.6.88 DTAG Internet ser...
General Check archive.org Show headers Download Go to Full URL https://temp1.ctl-users.net/wp-content/themes/twentytwentyone/style.css?ver=1.3 Requested by Host: temp1.ctl-users.net URL: https://temp1.ctl-users.net/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 93.240.6.88 Friedrichsdorf, Germany, ASN3320 (DTAG Internet service provider operations, DE), Reverse DNS p5df00658.dip0.t-ipconnect.de Software openresty / Resource Hash `f3f77e9548e051aecdc95699fa1b972d913a0a36a4d2fe2a7d274ebe7980cc8f` Request headers :path /wp-content/themes/twentytwentyone/style.css?ver=1.3 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,/;q=0.1 cache-control no-cache sec-fetch-dest style :authority temp1.ctl-users.net referer https://temp1.ctl-users.net/ :scheme https sec-fetch-site same-origin :method GET Referer https://temp1.ctl-users.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 13 Jul 2021 15:13:41 GMT content-encoding gzip last-modified Tue, 13 Jul 2021 14:59:47 GMT server openresty etag "25e31-5c7027d2aaf16-gzip" vary Accept-Encoding content-type text/css accept-ranges bytes content-length 22685 x-served-by temp1.ctl-users.net
GET H2	200	responsive-embeds.js Show response temp1.ctl-users.net/wp-content/themes/twentytwentyone/assets/js/	1 KB 755 B	60ms 60ms	Script application/javascript	93.240.6.88 DTAG Internet ser...
General Check archive.org Show headers Download Go to Full URL https://temp1.ctl-users.net/wp-content/themes/twentytwentyone/assets/js/responsive-embeds.js?ver=1.3 Requested by Host: temp1.ctl-users.net URL: https://temp1.ctl-users.net/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 93.240.6.88 Friedrichsdorf, Germany, ASN3320 (DTAG Internet service provider operations, DE), Reverse DNS p5df00658.dip0.t-ipconnect.de Software openresty / Resource Hash `c84b9432dad75b6cce98abcd62eecccc82cf4e293e92f80678d8d50bd1060cfe` Request headers :path /wp-content/themes/twentytwentyone/assets/js/responsive-embeds.js?ver=1.3 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept / cache-control no-cache sec-fetch-dest script :authority temp1.ctl-users.net referer https://temp1.ctl-users.net/ :scheme https sec-fetch-site same-origin :method GET Referer https://temp1.ctl-users.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 13 Jul 2021 15:13:41 GMT content-encoding gzip last-modified Tue, 13 Jul 2021 14:59:47 GMT server openresty etag "467-5c7027d2a9f76-gzip" vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 545 x-served-by temp1.ctl-users.net
GET H2	200	wp-embed.min.js Show response temp1.ctl-users.net/wp-includes/js/	1 KB 974 B	61ms 61ms	Script application/javascript	93.240.6.88 DTAG Internet ser...
General Check archive.org Show headers Download Go to Full URL https://temp1.ctl-users.net/wp-includes/js/wp-embed.min.js?ver=5.7.2 Requested by Host: temp1.ctl-users.net URL: https://temp1.ctl-users.net/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 93.240.6.88 Friedrichsdorf, Germany, ASN3320 (DTAG Internet service provider operations, DE), Reverse DNS p5df00658.dip0.t-ipconnect.de Software openresty / Resource Hash `5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991` Request headers :path /wp-includes/js/wp-embed.min.js?ver=5.7.2 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept / cache-control no-cache sec-fetch-dest script :authority temp1.ctl-users.net referer https://temp1.ctl-users.net/ :scheme https sec-fetch-site same-origin :method GET Referer https://temp1.ctl-users.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 13 Jul 2021 15:13:41 GMT content-encoding gzip last-modified Tue, 13 Jul 2021 14:59:47 GMT server openresty etag "592-5c7027d2ca317-gzip" vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 765 x-served-by temp1.ctl-users.net
GET H2	200	wp-emoji-release.min.js Show response temp1.ctl-users.net/wp-includes/js/	14 KB 5 KB	67ms 65ms	Script application/javascript	93.240.6.88 DTAG Internet ser...
General Check archive.org Show headers Download Go to Full URL https://temp1.ctl-users.net/wp-includes/js/wp-emoji-release.min.js?ver=5.7.2 Requested by Host: temp1.ctl-users.net URL: https://temp1.ctl-users.net/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 93.240.6.88 Friedrichsdorf, Germany, ASN3320 (DTAG Internet service provider operations, DE), Reverse DNS p5df00658.dip0.t-ipconnect.de Software openresty / Resource Hash `0c5f584d1ea2c3313dc8c55824c2a572d3cf2eae87c5ca62a58e598aec9ddb5c` Request headers :path /wp-includes/js/wp-emoji-release.min.js?ver=5.7.2 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept / cache-control no-cache sec-fetch-dest script :authority temp1.ctl-users.net referer https://temp1.ctl-users.net/ :scheme https sec-fetch-site same-origin :method GET Referer https://temp1.ctl-users.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 13 Jul 2021 15:13:41 GMT content-encoding gzip last-modified Tue, 13 Jul 2021 14:59:47 GMT server openresty etag "3795-5c7027d2ce197-gzip" vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 4662 x-served-by temp1.ctl-users.net
GET H2	200	print.css temp1.ctl-users.net/wp-content/themes/twentytwentyone/assets/css/	3 KB 1 KB	55ms 54ms	Stylesheet text/css	93.240.6.88 DTAG Internet ser...
General Check archive.org Show headers Download Go to Full URL https://temp1.ctl-users.net/wp-content/themes/twentytwentyone/assets/css/print.css?ver=1.3 Requested by Host: temp1.ctl-users.net URL: https://temp1.ctl-users.net/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 93.240.6.88 Friedrichsdorf, Germany, ASN3320 (DTAG Internet service provider operations, DE), Reverse DNS p5df00658.dip0.t-ipconnect.de Software openresty / Resource Hash `3467f3eee5c95a86bb4992918b1368458185bf349949f862e6e3c5954fcd69f9` Request headers :path /wp-content/themes/twentytwentyone/assets/css/print.css?ver=1.3 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,/;q=0.1 cache-control no-cache sec-fetch-dest style :authority temp1.ctl-users.net referer https://temp1.ctl-users.net/ :scheme https sec-fetch-site same-origin :method GET Referer https://temp1.ctl-users.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 13 Jul 2021 15:13:41 GMT content-encoding gzip last-modified Tue, 13 Jul 2021 14:59:47 GMT server openresty etag "b51-5c7027d2a7096-gzip" vary Accept-Encoding content-type text/css accept-ranges bytes content-length 1084 x-served-by temp1.ctl-users.net

Verdicts & Comments Add Verdict or Comment

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| _wpemojiSettings function| twentytwentyoneResponsiveEmbeds object| wp object| twemoji

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

temp1.ctl-users.net
93.240.6.88
0c5f584d1ea2c3313dc8c55824c2a572d3cf2eae87c5ca62a58e598aec9ddb5c
2cd9de3dd26246204749cff259bc34e8e6a47ae5d6e4528b9b28c75d68d50cde
3467f3eee5c95a86bb4992918b1368458185bf349949f862e6e3c5954fcd69f9
3ee638689e343730a82027d03714f274b6c665cf7e3bf60b5208a3a0cdb3581d
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991
c84b9432dad75b6cce98abcd62eecccc82cf4e293e92f80678d8d50bd1060cfe
ee7d829c4bdd529066f42172f10f0484ea6fbded4228ecedc4ffcd544fb6e901
f3f77e9548e051aecdc95699fa1b972d913a0a36a4d2fe2a7d274ebe7980cc8f