casafe.pro Open in urlscan Pro
185.254.198.31 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://casafe.pro/e-sweep-de/index.html?click_id=52857xok2fng50d64&uclick=xok2fng50&uclickhash=xok2fng50-xok2fng50...
Submission: On August 22 via manual (August 22nd 2024, 10:57:34 am UTC) from MA — Scanned from DE

Summary HTTP 8 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 8 HTTP transactions. The main IP is 185.254.198.31, located in New York, United States and belongs to YURTEH-AS, UA. The main domain is casafe.pro.
TLS certificate: Issued by E6 on July 25th 2024. Valid for: 3 months.

This is the only time casafe.pro was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
3	185.254.198.31 185.254.198.31	30860 (YURTEH-AS) (YURTEH-AS)
3	157.90.33.72 157.90.33.72	24940 (HETZNER-AS) (HETZNER-AS)
2	23.88.8.123 23.88.8.123	24940 (HETZNER-AS) (HETZNER-AS)
8	3

3 185.254.198.31 (New York, United States)

ASN30860 (YURTEH-AS, UA)
PTR: mail.fiberiatrade.com

casafe.pro	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 157.90.33.72 (Ismaning, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: sub2.1push.io

push-sdk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.88.8.123 (Gunzenhausen, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: eu7.1push.io

uidsync.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	push-sdk.com push-sdk.com — Cisco Umbrella Rank: 37968	16 KB
3	casafe.pro casafe.pro	18 KB
2	uidsync.net uidsync.net — Cisco Umbrella Rank: 36672	704 B
8	3

	Domain	Requested by
3	push-sdk.com	casafe.pro push-sdk.com
3	casafe.pro	casafe.pro
2	uidsync.net	push-sdk.com
8	3

This site contains links to these domains. Also see Links.

Domain
kateroi.pro

Subject Issuer	Validity	Valid
casafe.pro E6	`2024-07-25` - `2024-10-23`	3 months	crt.sh
push-sdk.com R11	`2024-06-12` - `2024-09-10`	3 months	crt.sh
uidsync.net Sectigo RSA Domain Validation Secure Server CA	`2023-12-30` - `2025-01-29`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://casafe.pro/e-sweep-de/index.html?click_id=52857xok2fng50d64&uclick=xok2fng50&uclickhash=xok2fng50-xok2fng50-8w7v-0-9z4p-u3pmwj-u3pmbl-329d3f
Frame ID: D19AE8F112FDDC532924B182A9B34694
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sie haben einen Geschenkgutschein gewonnen

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

35 kB
Transfer

170 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://kateroi.pro/click.php?lp=1
Title: Sie haben einen Geschenkgutschein gewonnen! Ihre Quittung wurde ausgewählt, um einen Amazon-Geschenkgutschein zu gewinnen. Klicken Sie auf WEITER und folgen Sie den Aufforderungen, um die 5 einfachen Fragen zu beantworten.

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index.html Show response casafe.pro/e-sweep-de/	115 KB 15 KB	449ms 126ms	Document text/html	185.254.198.31 YURTEH-AS
General Check archive.org Show headers Download Go to Full URL https://casafe.pro/e-sweep-de/index.html?click_id=52857xok2fng50d64&uclick=xok2fng50&uclickhash=xok2fng50-xok2fng50-8w7v-0-9z4p-u3pmwj-u3pmbl-329d3f Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.254.198.31 New York, United States, ASN30860 (YURTEH-AS, UA), Reverse DNS mail.fiberiatrade.com Software nginx / Resource Hash `e7b0e90a5435df9fd4d8e457e3ca3fc43d757c5ab77a99e3ff21a396425c039d` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Connection keep-alive Content-Encoding gzip Content-Type text/html Date Thu, 22 Aug 2024 10:57:30 GMT ETag W/"65805a06-1ccb8" Last-Modified Mon, 18 Dec 2023 14:41:10 GMT Server nginx Transfer-Encoding chunked Vary Accept-Encoding
GET H/1.1	200 OK	41d8cc10740ed756afbe870c6da85e10.static.png casafe.pro/e-sweep-de/	3 KB 3 KB	65ms 65ms	Image image/png	185.254.198.31 YURTEH-AS
General Check archive.org Show headers Download Go to Show image Full URL https://casafe.pro/e-sweep-de/41d8cc10740ed756afbe870c6da85e10.static.png Requested by Host: casafe.pro URL: https://casafe.pro/e-sweep-de/index.html?click_id=52857xok2fng50d64&uclick=xok2fng50&uclickhash=xok2fng50-xok2fng50-8w7v-0-9z4p-u3pmwj-u3pmbl-329d3f Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.254.198.31 New York, United States, ASN30860 (YURTEH-AS, UA), Reverse DNS mail.fiberiatrade.com Software nginx / Resource Hash `35acb88ac15dd098eee7a515d0764b8b5a3ed4c8c8d307f7b3115464796973e8` Request headers Referer https://casafe.pro/e-sweep-de/index.html?click_id=52857xok2fng50d64&uclick=xok2fng50&uclickhash=xok2fng50-xok2fng50-8w7v-0-9z4p-u3pmwj-u3pmbl-329d3f User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Date Thu, 22 Aug 2024 10:57:30 GMT Last-Modified Mon, 18 Dec 2023 14:41:10 GMT Server nginx ETag "65805a06-adc" Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 2780
GET H2	200	sdk.js Show response push-sdk.com/f/	52 KB 15 KB	186ms 43ms	Script application/javascript	157.90.33.72 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://push-sdk.com/f/sdk.js?z=869324 Requested by Host: casafe.pro URL: https://casafe.pro/e-sweep-de/index.html?click_id=52857xok2fng50d64&uclick=xok2fng50&uclickhash=xok2fng50-xok2fng50-8w7v-0-9z4p-u3pmwj-u3pmbl-329d3f Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 157.90.33.72 Ismaning, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS sub2.1push.io Software Angie / Resource Hash `7a54a48535e98ca46d1275d906a69cb3a95a5026a5034ef300ec56318155d38e` Request headers Referer https://casafe.pro/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Thu, 22 Aug 2024 10:57:30 GMT content-encoding gzip cache-control no-cache, max-age=0, must-revalidate, proxy-revalidate server Angie content-length 15349 vary Accept-Encoding content-type application/javascript; charset=utf-8
POST H2	200	event push-sdk.com/	0 523 B	41ms 40ms	Ping text/plain	157.90.33.72 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://push-sdk.com/event?z=869324 Requested by Host: push-sdk.com URL: https://push-sdk.com/f/sdk.js?z=869324 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 157.90.33.72 Ismaning, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS sub2.1push.io Software Angie / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://casafe.pro/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers pragma no-cache date Thu, 22 Aug 2024 10:57:30 GMT server Angie accept-ch Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64 access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin https://casafe.pro access-control-expose-headers Authorization cache-control no-cache, max-age=0, must-revalidate, proxy-revalidate, no-store access-control-allow-credentials true access-control-allow-headers Accept, Content-Type, Content-Length, Accept-Encoding, Authorization, X-CSRF-Token content-length 0 expires Tue, 11 Jan 1994 00:00:00 GMT
GET H/1.1	404 Not Found	favicon.ico casafe.pro/	16 B 264 B	64ms 64ms	Other text/html	185.254.198.31 YURTEH-AS
General Check archive.org Show headers Download Go to Full URL https://casafe.pro/favicon.ico Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.254.198.31 New York, United States, ASN30860 (YURTEH-AS, UA), Reverse DNS mail.fiberiatrade.com Software nginx / Resource Hash `8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41` Request headers Referer https://casafe.pro/e-sweep-de/index.html?click_id=52857xok2fng50d64&uclick=xok2fng50&uclickhash=xok2fng50-xok2fng50-8w7v-0-9z4p-u3pmwj-u3pmbl-329d3f User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Date Thu, 22 Aug 2024 10:57:30 GMT Content-Encoding gzip Server nginx Connection keep-alive Transfer-Encoding chunked Vary Accept-Encoding Content-Type text/html; charset=UTF-8
OPTIONS H2	204	sync uidsync.net/	0 0	135ms 38ms	Preflight	23.88.8.123 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://uidsync.net/sync?user_id=QViIhv7tR20rOAgA7jQJ55 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 23.88.8.123 Gunzenhausen, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS eu7.1push.io Software Angie / Resource Hash Request headers Accept / Access-Control-Request-Headers content-type Access-Control-Request-Method GET Origin https://casafe.pro Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers accept-ch Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64 access-control-allow-credentials true access-control-allow-headers Accept, Content-Type, Content-Length, Accept-Encoding, Authorization, X-CSRF-Token access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin https://casafe.pro access-control-expose-headers Authorization cache-control no-cache, max-age=0, must-revalidate, proxy-revalidate, no-store date Thu, 22 Aug 2024 10:57:30 GMT expires Tue, 11 Jan 1994 00:00:00 GMT pragma no-cache server Angie
GET H2	200	sync Show response uidsync.net/	62 B 704 B	118ms 40ms	Fetch application/json	23.88.8.123 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://uidsync.net/sync?user_id=QViIhv7tR20rOAgA7jQJ55 Requested by Host: push-sdk.com URL: https://push-sdk.com/f/sdk.js?z=869324 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 23.88.8.123 Gunzenhausen, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS eu7.1push.io Software Angie / Resource Hash `606b551a34e7c343dd75cb28b0c7a70458d43779b2d44841f6c30f1c719fb92c` Request headers Referer https://casafe.pro/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Content-Type application/json Response headers pragma no-cache date Thu, 22 Aug 2024 10:57:30 GMT server Angie accept-ch Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64 access-control-allow-methods GET, POST, OPTIONS content-type application/json; charset=utf-8 access-control-allow-origin https://casafe.pro access-control-expose-headers Authorization cache-control no-cache, max-age=0, must-revalidate, proxy-revalidate, no-store access-control-allow-credentials true access-control-allow-headers Accept, Content-Type, Content-Length, Accept-Encoding, Authorization, X-CSRF-Token content-length 62 expires Tue, 11 Jan 1994 00:00:00 GMT
POST H2	200	event push-sdk.com/	0 524 B	120ms 40ms	Ping text/plain	157.90.33.72 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://push-sdk.com/event?z=869324 Requested by Host: push-sdk.com URL: https://push-sdk.com/f/sdk.js?z=869324 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 157.90.33.72 Ismaning, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS sub2.1push.io Software Angie / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://casafe.pro/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers pragma no-cache date Thu, 22 Aug 2024 10:57:32 GMT server Angie accept-ch Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64 access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin https://casafe.pro access-control-expose-headers Authorization cache-control no-cache, max-age=0, must-revalidate, proxy-revalidate, no-store access-control-allow-credentials true access-control-allow-headers Accept, Content-Type, Content-Length, Accept-Encoding, Authorization, X-CSRF-Token content-length 0 expires Tue, 11 Jan 1994 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			uidsync.net/	1970-01-21 07:44:20	Name: rauid Value: QViIhv7tR20rOAgA7jQJ55

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://casafe.pro/favicon.ico Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

casafe.pro
push-sdk.com
uidsync.net
157.90.33.72
185.254.198.31
23.88.8.123
35acb88ac15dd098eee7a515d0764b8b5a3ed4c8c8d307f7b3115464796973e8
606b551a34e7c343dd75cb28b0c7a70458d43779b2d44841f6c30f1c719fb92c
7a54a48535e98ca46d1275d906a69cb3a95a5026a5034ef300ec56318155d38e
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e7b0e90a5435df9fd4d8e457e3ca3fc43d757c5ab77a99e3ff21a396425c039d

casafe.pro Open in urlscan Pro 185.254.198.31 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

8 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

35 kBTransfer

170 kBSize

1 Cookies

1 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

casafe.pro Open in urlscan Pro
185.254.198.31 Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

35 kB
Transfer

170 kB
Size

1
Cookies

8 HTTP transactions
0 data transactions