urlscan.io logo urlscan.io
SecurityTrails logo

ww12.nullreferer.com Open in urlscan Pro
13.248.148.254  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://lvh-ee.triangulo30.pt/jqddadantsdc
Effective URL: https://ww12.nullreferer.com/?https://google.com&usid=16&utid=33532973711
Submission: On June 27 via manual from EE — Scanned from PT
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 3 countries across 3 domains to perform 3 HTTP transactions. The main IP is 13.248.148.254, located in and belongs to . The main domain is ww12.nullreferer.com.
TLS certificate: Issued by R3 on June 4th 2024. Valid for: 3 months.
This is the only time ww12.nullreferer.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 185.12.116.103 33876 (FLESK-AS)
1 1 45.80.132.100 208898 (SUPERHOST...)
1 1 172.234.222.138 63949 (AKAMAI-LI...)
1 1 72.52.179.174 ()
1 13.248.148.254 ()
3 2
2    185.12.116.103 (Portugal)

ASN33876 (FLESK-AS, PT)
PTR: cpanel103.dnscpanel.com
lvh-ee.triangulo30.pt
1    45.80.132.100 (Serbia)

ASN208898 (SUPERHOSTINGRS_AS, RS)
PTR: host-45-80-132-100.superhosting.rs
lhv-eestis.balkanzone.rs
1    172.234.222.138 (Chicago, United States)

ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG)
PTR: 172-234-222-138.ip.linodeusercontent.com
nullreferer.com
1    72.52.179.174 (None, )

ASN- ()
ww99.nullreferer.com
1    13.248.148.254 (None, )

ASN- ()
ww12.nullreferer.com
Domain Requested by
2 lvh-ee.triangulo30.pt
1 ww12.nullreferer.com
1 ww99.nullreferer.com 1 redirects
1 nullreferer.com 1 redirects
1 lhv-eestis.balkanzone.rs 1 redirects
3 5

This site contains no links.

Subject Issuer Validity Valid
triangulo30.pt
R3		 2024-05-22 -
2024-08-20		 3 months crt.sh
defaultcontent.com
R3		 2024-06-04 -
2024-09-02		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://ww12.nullreferer.com/?https://google.com&usid=16&utid=33532973711
Frame ID: 2764E03EB1F247A5EFAC8795C9636362
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://lvh-ee.triangulo30.pt/jqddadantsdc HTTP 307
    https://lvh-ee.triangulo30.pt/jqddadantsdc Page URL
  2. https://lhv-eestis.balkanzone.rs/ HTTP 302
    https://nullreferer.com/?https://google.com HTTP 302
    http://ww99.nullreferer.com/?https://google.com HTTP 307
    https://ww99.nullreferer.com/?https://google.com HTTP 307
    http://ww99.nullreferer.com/?https://google.com HTTP 302
    http://ww12.nullreferer.com/?https://google.com&usid=16&utid=33532973711 HTTP 307
    https://ww12.nullreferer.com/?https://google.com&usid=16&utid=33532973711 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns

Page Statistics

3
Requests

67 %
HTTPS

0 %
IPv6

3
Domains

5
Subdomains

2
IPs

3
Countries

1 kB
Transfer

16 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://lvh-ee.triangulo30.pt/jqddadantsdc HTTP 307
    https://lvh-ee.triangulo30.pt/jqddadantsdc Page URL
  2. https://lhv-eestis.balkanzone.rs/ HTTP 302
    https://nullreferer.com/?https://google.com HTTP 302
    http://ww99.nullreferer.com/?https://google.com HTTP 307
    https://ww99.nullreferer.com/?https://google.com HTTP 307
    http://ww99.nullreferer.com/?https://google.com HTTP 302
    http://ww12.nullreferer.com/?https://google.com&usid=16&utid=33532973711 HTTP 307
    https://ww12.nullreferer.com/?https://google.com&usid=16&utid=33532973711 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://lvh-ee.triangulo30.pt/jqddadantsdc HTTP 307
  • https://lvh-ee.triangulo30.pt/jqddadantsdc

3 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
jqddadantsdc
lvh-ee.triangulo30.pt/
Redirect Chain
  • http://lvh-ee.triangulo30.pt/jqddadantsdc
  • https://lvh-ee.triangulo30.pt/jqddadantsdc
129 B
271 B 		Document
General
Check archive.org
Download Go to
Full URL
https://lvh-ee.triangulo30.pt/jqddadantsdc
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.12.116.103 , Portugal, ASN33876 (FLESK-AS, PT),
Reverse DNS
cpanel103.dnscpanel.com
Software
nginx / PHP/8.2.20
Resource Hash
d375781be27844194f2fe7f5b3d11db795f918624ed0093877b191e8977ceb7e

Request headers

Accept-Language
pt-PT,pt;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Thu, 27 Jun 2024 09:27:39 GMT
server
nginx
vary
Accept-Encoding
x-powered-by
PHP/8.2.20
x-scale
YXBvY2FzQGdpdGh1Yg==

Redirect headers

Location
https://lvh-ee.triangulo30.pt/jqddadantsdc
Non-Authoritative-Reason
HttpsUpgrades
Primary Request /
ww12.nullreferer.com/
Redirect Chain
  • https://lhv-eestis.balkanzone.rs/
  • https://nullreferer.com/?https://google.com
  • http://ww99.nullreferer.com/?https://google.com
  • https://ww99.nullreferer.com/?https://google.com
  • http://ww99.nullreferer.com/?https://google.com
  • http://ww12.nullreferer.com/?https://google.com&usid=16&utid=33532973711
  • https://ww12.nullreferer.com/?https://google.com&usid=16&utid=33532973711
15 KB
0 		Document
General
Check archive.org
Download Go to
Full URL
https://ww12.nullreferer.com/?https://google.com&usid=16&utid=33532973711
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.248.148.254 -, , ASN (),
Reverse DNS
Software
Caddy nginx /
Resource Hash

Request headers

Accept-Language
pt-PT,pt;q=0.9;q=0.9
Referer
https://lvh-ee.triangulo30.pt/jqddadantsdc
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

accept-ch
viewport-width dpr device-memory rtt downlink ect ua ua-full-version ua-platform ua-platform-version ua-arch ua-model ua-mobile
accept-ch-lifetime
30
alt-svc
h3=":50944"; ma=2592000
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Thu, 27 Jun 2024 09:27:46 GMT
server
Caddy nginx
vary
Accept-Encoding
x-adblock-key
MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_JQW5aXpkxfmzDk4KBPjQGnrm7wwlG6/mu7StG4Tat3ID8uy720S0vXh9zDFStmqZ5UTC+XdPeU0z0i5gzZ1jyQ==
x-buckets
bucket061,bucket077
x-domain
nullreferer.com
x-language
german
x-subdomain
ww12
x-template
tpl_CleanPeppermintBlack_twoclick

Redirect headers

Location
https://ww12.nullreferer.com/?https://google.com&usid=16&utid=33532973711
Non-Authoritative-Reason
HttpsUpgrades
favicon.ico
lvh-ee.triangulo30.pt/ 		129 B
268 B 		Other
General
Check archive.org
Download Go to
Full URL
https://lvh-ee.triangulo30.pt/favicon.ico
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.12.116.103 , Portugal, ASN33876 (FLESK-AS, PT),
Reverse DNS
cpanel103.dnscpanel.com
Software
nginx / PHP/8.2.20
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://lvh-ee.triangulo30.pt/jqddadantsdc
Accept-Language
pt-PT,pt;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-type
static
date
Thu, 27 Jun 2024 09:27:39 GMT
content-encoding
gzip
server
nginx
x-powered-by
PHP/8.2.20
vary
Accept-Encoding
x-cache
HIT
content-type
text/html; charset=UTF-8

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage

1 Cookies

Domain/Path Name / Value
lhv-eestis.balkanzone.rs/ Name: sf_redirect
Value: %7B%22token%22%3A%229f700d%22%2C%22route%22%3A%22app_frontoffice_index%22%2C%22method%22%3A%22GET%22%2C%22controller%22%3A%7B%22class%22%3A%22App%5C%5CController%5C%5CFrontOfficeController%22%2C%22method%22%3A%22index%22%2C%22file%22%3A%22%5C%2Fhome%5C%2Fbalkanzors%5C%2Flhv-eestis.balkanzone.rs%5C%2Fsrc%5C%2FController%5C%2FFrontOfficeController.php%22%2C%22line%22%3A28%7D%2C%22status_code%22%3A302%2C%22status_text%22%3A%22Found%22%7D

1 Console Messages

Source Level URL
Text
security error URL: https://ww12.nullreferer.com/?https://google.com&usid=16&utid=33532973711
Message:
Mixed Content: The page at 'https://ww12.nullreferer.com/?https://google.com&usid=16&utid=33532973711' was loaded over HTTPS, but requested an insecure script 'http://parking.parklogic.com/page/enhance.js?pcId=12&domain=nullreferer.com'. This request has been blocked; the content must be served over HTTPS.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

lhv-eestis.balkanzone.rs
lvh-ee.triangulo30.pt
nullreferer.com
ww12.nullreferer.com
ww99.nullreferer.com
13.248.148.254
172.234.222.138
185.12.116.103
45.80.132.100
72.52.179.174
d375781be27844194f2fe7f5b3d11db795f918624ed0093877b191e8977ceb7e