bucks.shady.tel - urlscan.io

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 7 HTTP transactions. The main IP is 2602:fce8:1:0:3b99:6156:83b0:34d7, located in United States and belongs to DOOF, US. The main domain is bucks.shady.tel.
TLS certificate: Issued by R3 on May 4th 2024. Valid for: 3 months.

This is the only time bucks.shady.tel was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 5	2602:fce8:1:0... 2602:fce8:1:0:3b99:6156:83b0:34d7	395823 (DOOF) (DOOF)
4	103.168.172.52 103.168.172.52	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
7	2

5 2602:fce8:1:0:3b99:6156:83b0:34d7 (United States) 2 redirects

ASN395823 (DOOF, US)

bucks.shady.tel	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 103.168.172.52 (Bridgewater, United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)
PTR: web.messagingengine.com

shady.tel	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	shady.tel 2 redirects bucks.shady.tel shady.tel	107 KB
7	1

	Domain	Requested by
5	bucks.shady.tel	2 redirects bucks.shady.tel
4	shady.tel	bucks.shady.tel
7	2

This site contains no links.

Subject Issuer	Validity	Valid
bucks.shady.tel R3	`2024-05-04` - `2024-08-02`	3 months	crt.sh
shady.tel R3	`2024-05-21` - `2024-08-19`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://bucks.shady.tel/app/login
Frame ID: 5BA3CCD8302B1C0CA7956DA6C38BEA6D
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Shadybucks: Log In

Page URL History Show full URLs

http://bucks.shady.tel/ HTTP 307
https://bucks.shady.tel/ HTTP 301
https://bucks.shady.tel/app/account HTTP 302
https://bucks.shady.tel/app/login Page URL

Page Statistics

7
Requests

100 %
HTTPS

50 %
IPv6

1
Domains

2
Subdomains

2
IPs

1
Countries

106 kB
Transfer

104 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://bucks.shady.tel/ HTTP 307
https://bucks.shady.tel/ HTTP 301
https://bucks.shady.tel/app/account HTTP 302
https://bucks.shady.tel/app/login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request login Show response bucks.shady.tel/app/ Redirect Chain http://bucks.shady.tel/ https://bucks.shady.tel/ https://bucks.shady.tel/app/account https://bucks.shady.tel/app/login	1 KB 1 KB	186ms 186ms	Document text/html	2602:fce8:1:0:3b99:6156:83b0:34d7 DOOF
General Check archive.org Show headers Download Go to Full URL https://bucks.shady.tel/app/login Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2602:fce8:1:0:3b99:6156:83b0:34d7 , United States, ASN395823 (DOOF, US), Reverse DNS Software nginx/1.18.0 (Ubuntu) / Resource Hash `57c6c05ca09c0980d5a9025ffb3a8572b40de743cbeedc9ed92ec1f67c748c3c` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Response headers Connection keep-alive Content-Length 1242 Content-Type text/html; charset=utf-8 Date Thu, 06 Jun 2024 01:38:41 GMT Server nginx/1.18.0 (Ubuntu) Redirect headers Connection keep-alive Content-Length 10 Content-Type text/plain; charset=utf-8 Date Thu, 06 Jun 2024 01:38:41 GMT Location /app/login Server nginx/1.18.0 (Ubuntu)
GET H/1.1	200 OK	style.css bucks.shady.tel/static/	2 KB 2 KB	207ms 206ms	Stylesheet text/css	2602:fce8:1:0:3b99:6156:83b0:34d7 DOOF
General Check archive.org Show headers Download Go to Full URL https://bucks.shady.tel/static/style.css Requested by Host: bucks.shady.tel URL: https://bucks.shady.tel/app/login Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2602:fce8:1:0:3b99:6156:83b0:34d7 , United States, ASN395823 (DOOF, US), Reverse DNS Software nginx/1.18.0 (Ubuntu) / Resource Hash `c114b89f816338d73b39b30f886cf4fbdeca00b5d3d21d683ab5f87a36819e66` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://bucks.shady.tel/app/login Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Thu, 06 Jun 2024 01:38:41 GMT Last-Modified Mon, 11 Jul 2022 23:31:51 GMT Server nginx/1.18.0 (Ubuntu) Connection keep-alive Accept-Ranges bytes Content-Length 2174 Content-Type text/css
GET H2	200	shadytel_logo.svg shady.tel/images/	4 KB 4 KB	1024ms 153ms	Image image/svg+xml	103.168.172.52 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Show image Full URL https://shady.tel/images/shadytel_logo.svg Requested by Host: bucks.shady.tel URL: https://bucks.shady.tel/app/login Protocol H2 Security TLS 1.3, , AES_128_GCM Server 103.168.172.52 Bridgewater, United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS web.messagingengine.com Software nginx / Resource Hash `3e77d1888fd3732b3826909550344686e2c1b620ff86f87a557b66f7926dc6c7` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://bucks.shady.tel/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-trace-id ti_5a0db0172fa0ee66934ddcbb672da1f7 date Thu, 06 Jun 2024 01:38:42 GMT x-frontend frontend2 last-modified Sun, 16 Apr 2017 03:45:04 GMT server nginx x-backend web2, web2 etag "0bb57e68ef8d03b8727b0d7502ddad8068afe4f4" content-type image/svg+xml access-control-allow-origin * content-disposition inline content-length 4328
GET H2	200	EurostileTBla.woff shady.tel/fonts/	56 KB 56 KB	807ms 149ms	Font application/octet-stream	103.168.172.52 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://shady.tel/fonts/EurostileTBla.woff Requested by Host: bucks.shady.tel URL: https://bucks.shady.tel/static/style.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 103.168.172.52 Bridgewater, United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS web.messagingengine.com Software nginx / Resource Hash `1caf5a0828e2054b7f4c35280340e11a169ac7975657748342ee8540a0c93420` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://bucks.shady.tel/ Origin https://bucks.shady.tel Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-trace-id ti_dd82c93b581d611c746ee213566e7302 date Thu, 06 Jun 2024 01:38:42 GMT x-frontend frontend2 last-modified Sun, 16 Apr 2017 01:26:42 GMT server nginx x-backend web2, web2 etag "c2a1c2d54b1777e87c4daa7dc97a7a40f0a660f3" content-type application/octet-stream access-control-allow-origin * content-disposition inline content-length 57032
GET H2	200	bellgothic-black.woff shady.tel/fonts/	21 KB 21 KB	1085ms 426ms	Font application/octet-stream	103.168.172.52 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://shady.tel/fonts/bellgothic-black.woff Requested by Host: bucks.shady.tel URL: https://bucks.shady.tel/static/style.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 103.168.172.52 Bridgewater, United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS web.messagingengine.com Software nginx / Resource Hash `2cefe21bfe01a8817a871330c4ea1011de52c42c03fa3278beacc0894e34f2f3` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://bucks.shady.tel/ Origin https://bucks.shady.tel Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-trace-id ti_55f32ddeb1560903da148d9180a1f84e date Thu, 06 Jun 2024 01:38:42 GMT x-frontend frontend2 last-modified Sun, 16 Apr 2017 01:26:46 GMT server nginx x-backend web2, web2 etag "7d0c3721b9a8d7e5d68bf6c9ebdc5735d0e17f11" content-type application/octet-stream access-control-allow-origin * content-disposition inline content-length 21180
GET H2	200	bellgothic.woff shady.tel/fonts/	20 KB 20 KB	1085ms 427ms	Font application/octet-stream	103.168.172.52 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://shady.tel/fonts/bellgothic.woff Requested by Host: bucks.shady.tel URL: https://bucks.shady.tel/static/style.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 103.168.172.52 Bridgewater, United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS web.messagingengine.com Software nginx / Resource Hash `664af985b1b6a3c263a695d334538dd9b7e6f0ae602b7558d9dc61c08e91f14f` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://bucks.shady.tel/ Origin https://bucks.shady.tel Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-trace-id ti_4a145919081780f0b09628872c0d86e7 date Thu, 06 Jun 2024 01:38:42 GMT x-frontend frontend2 last-modified Sun, 16 Apr 2017 01:24:31 GMT server nginx x-backend web2, web2 etag "48276eaa42da129c7241582efc434e377f82ad77" content-type application/octet-stream access-control-allow-origin * content-disposition inline content-length 20456
GET H/1.1	404 Not Found	favicon.ico bucks.shady.tel/	564 B 728 B	197ms 197ms	Other text/html	2602:fce8:1:0:3b99:6156:83b0:34d7 DOOF
General Check archive.org Show headers Download Go to Full URL https://bucks.shady.tel/favicon.ico Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2602:fce8:1:0:3b99:6156:83b0:34d7 , United States, ASN395823 (DOOF, US), Reverse DNS Software nginx/1.18.0 (Ubuntu) / Resource Hash `3c8cc37a98346bd0123b35e5ccd87bd07d69914dae04f8b49f61c150d96e9d1f` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://bucks.shady.tel/app/login Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Thu, 06 Jun 2024 01:38:43 GMT Server nginx/1.18.0 (Ubuntu) Connection keep-alive Content-Length 564 Content-Type text/html

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			bucks.shady.tel/	1970-01-20 21:50:29	Name: sid Value: sEYalSRhumNNUdSlZ-V9yhvThUVw6F3N87NT6R8vU60

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://bucks.shady.tel/favicon.ico Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bucks.shady.tel
shady.tel
103.168.172.52
2602:fce8:1:0:3b99:6156:83b0:34d7
1caf5a0828e2054b7f4c35280340e11a169ac7975657748342ee8540a0c93420
2cefe21bfe01a8817a871330c4ea1011de52c42c03fa3278beacc0894e34f2f3
3c8cc37a98346bd0123b35e5ccd87bd07d69914dae04f8b49f61c150d96e9d1f
3e77d1888fd3732b3826909550344686e2c1b620ff86f87a557b66f7926dc6c7
57c6c05ca09c0980d5a9025ffb3a8572b40de743cbeedc9ed92ec1f67c748c3c
664af985b1b6a3c263a695d334538dd9b7e6f0ae602b7558d9dc61c08e91f14f
c114b89f816338d73b39b30f886cf4fbdeca00b5d3d21d683ab5f87a36819e66

bucks.shady.tel Open in urlscan Pro 2602:fce8:1:0:3b99:6156:83b0:34d7 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

7 Requests

100 %HTTPS

50 %IPv6

1 Domains

2 Subdomains

2 IPs

1 Countries

106 kBTransfer

104 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

bucks.shady.tel Open in urlscan Pro
2602:fce8:1:0:3b99:6156:83b0:34d7 Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

50 %
IPv6

1
Domains

2
Subdomains

2
IPs

1
Countries

106 kB
Transfer

104 kB
Size

1
Cookies

7 HTTP transactions
0 data transactions