alibi44.com Open in urlscan Pro
190.115.27.130 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://mybluesky.tv/wp-content/themes/Grow_Pro/languages/payments/index_copy.html
Effective URL:
https://alibi44.com/h/superloto/
Submission: On March 07 via manual (March 7th 2020, 7:15:14 am UTC)

Summary HTTP 33 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 33 HTTP transactions. The main IP is 190.115.27.130, located in Belize and belongs to DDOS-GUARD CORP., BZ. The main domain is alibi44.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on February 24th 2020. Valid for: 3 months.

This is the only time alibi44.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	209.17.116.165 209.17.116.165	55002 (DEFENSE-NET) (DEFENSE-NET)
1 3	190.115.26.114 190.115.26.114	262254 (DDOS-GUAR...) (DDOS-GUARD CORP.)
1 2	190.115.27.130 190.115.27.130	262254 (DDOS-GUAR...) (DDOS-GUARD CORP.)
33	4

1 209.17.116.165 (Jacksonville, United States)

ASN55002 (DEFENSE-NET, US)

mybluesky.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 190.115.26.114 (Belize) 1 redirects

ASN262254 (DDOS-GUARD CORP., BZ)
PTR: 190-115-26-114.bilibili.be

payme.buzz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 190.115.27.130 (Belize) 1 redirects

ASN262254 (DDOS-GUARD CORP., BZ)
PTR: ddos-guard.net

alibi44.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	payme.buzz 1 redirects payme.buzz	30 KB
2	alibi44.com 1 redirects alibi44.com	244 B
1	mybluesky.tv mybluesky.tv	813 B
0	yandex.ru Failed api-maps.yandex.ru Failed
33	4

	Domain	Requested by
3	payme.buzz	1 redirects mybluesky.tv payme.buzz
2	alibi44.com	1 redirects payme.buzz alibi44.com
1	mybluesky.tv
0	api-maps.yandex.ru Failed	alibi44.com
33	4

This site contains no links.

Subject Issuer	Validity	Valid
www.mybluesky.tv Network Solutions DV Server CA 2	`2019-06-28` - `2020-04-26`	10 months	crt.sh
www.payme.buzz Let's Encrypt Authority X3	`2020-03-04` - `2020-06-02`	3 months	crt.sh
alibi44.com Let's Encrypt Authority X3	`2020-02-24` - `2020-05-24`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://alibi44.com/h/superloto/
Frame ID: C94B27561CCE675E12A7089BAD4FB5D1
Requests: 33 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://mybluesky.tv/wp-content/themes/Grow_Pro/languages/payments/index_copy.html Page URL
https://payme.buzz/d/5e4a20bd16b63 Page URL
https://payme.buzz/check-unique/index?unique_code=3658fbf830bc6df3dd3525f68b1f86d8&link_type=pa... HTTP 302
https://alibi44.com/h/superloto HTTP 301
http://alibi44.com/h/superloto/ HTTP 307
https://alibi44.com/h/superloto/ Page URL

Detected technologies

Lua (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

OpenResty (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

Page Statistics

33
Requests

12 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

31 kB
Transfer

44 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://mybluesky.tv/wp-content/themes/Grow_Pro/languages/payments/index_copy.html Page URL
https://payme.buzz/d/5e4a20bd16b63 Page URL
https://payme.buzz/check-unique/index?unique_code=3658fbf830bc6df3dd3525f68b1f86d8&link_type=partner&code=5e4a20bd16b63&u=&url=https://alibi44.com/h/superloto&upgrade=03abf82a78f5d HTTP 302
https://alibi44.com/h/superloto HTTP 301
http://alibi44.com/h/superloto/ HTTP 307
https://alibi44.com/h/superloto/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

33 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK index_copy.html Show response
mybluesky.tv/wp-content/themes/Grow_Pro/languages/payments/ 518 B
813 B 636ms
265ms Document
text/html 209.17.116.165
DEFENSE-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://mybluesky.tv/wp-content/themes/Grow_Pro/languages/payments/index_copy.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 209.17.116.165 Jacksonville, United States, ASN55002 (DEFENSE-NET, US),
Reverse DNS
Software: openresty/1.13.6.2 /
Resource Hash: 19b2d634386ee866a8eada2d5e2212ed4fd454d91dd5d504fb17f5747310fa22

Request headers

Host: mybluesky.tv
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document

Response headers

Server: openresty/1.13.6.2
Date: Sat, 07 Mar 2020 07:14:54 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 518
Connection: keep-alive
Last-Modified: Thu, 20 Feb 2020 23:17:06 GMT
ETag: "206-59f0a1a764080"
X-Webcom-Cache-Status: BYPASS
Accept-Ranges: bytes

GET
H2 200 5e4a20bd16b63 Show response
payme.buzz/d/ 1 KB
971 B 1104ms
109ms Document
text/html 190.115.26.114
DDOS-GUARD CORP.

General

Check archive.org

Show headers Download Go to

Full URL

https://payme.buzz/d/5e4a20bd16b63

Requested by

Host: mybluesky.tv
URL: https://mybluesky.tv/wp-content/themes/Grow_Pro/languages/payments/index_copy.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

190.115.26.114 , Belize, ASN262254 (DDOS-GUARD CORP., BZ),

Reverse DNS

190-115-26-114.bilibili.be

Software

nginx /

Resource Hash

8304a3a749ff137e5f1cb34936623302b1f032d9a8176d24a6ba0dab2277c4db

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

:method: GET
:authority: payme.buzz
:scheme: https
:path: /d/5e4a20bd16b63
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: document
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://mybluesky.tv/wp-content/themes/Grow_Pro/languages/payments/index_copy.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document
Referer: https://mybluesky.tv/wp-content/themes/Grow_Pro/languages/payments/index_copy.html

Response headers

status: 200
server: nginx
date: Sat, 07 Mar 2020 07:14:59 GMT
content-type: text/html; charset=UTF-8
strict-transport-security: max-age=15768000; includeSubdomains; preload
x-content-type-options: nosniff
content-encoding: gzip

GET
H2 200 fp21.min.js Show response
payme.buzz/frontend/web/js/ 29 KB
29 KB 113ms
113ms Script
application/javascript 190.115.26.114
DDOS-GUARD CORP.

General

Check archive.org

Show headers Download Go to

Full URL

https://payme.buzz/frontend/web/js/fp21.min.js

Requested by

Host: payme.buzz
URL: https://payme.buzz/d/5e4a20bd16b63

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

190.115.26.114 , Belize, ASN262254 (DDOS-GUARD CORP., BZ),

Reverse DNS

190-115-26-114.bilibili.be

Software

nginx /

Resource Hash

af4ac135cf575e46eb783d82f6c659d92afb5e31b647e2ac9d62530c3e371bdb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://payme.buzz/d/5e4a20bd16b63
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Sat, 07 Mar 2020 07:14:59 GMT
x-content-type-options: nosniff
last-modified: Thu, 15 Aug 2019 12:05:02 GMT
server: nginx
etag: "5d554a6e-7309"
strict-transport-security: max-age=15768000; includeSubdomains; preload
content-type: application/javascript
status: 200
accept-ranges: bytes
content-length: 29449

GET
H2

200

Primary Request /
alibi44.com/h/superloto/
Redirect Chain

https://payme.buzz/check-unique/index?unique_code=3658fbf830bc6df3dd3525f68b1f86d8&link_type=partner&code=5e4a20bd16b63&u=&url=https://alibi44.com/h/superloto&upgrade=03abf82a78f5d
https://alibi44.com/h/superloto
http://alibi44.com/h/superloto/
https://alibi44.com/h/superloto/

13 KB
0

58ms
58ms

Document
text/html

190.115.27.130
DDOS-GUARD CORP.

General

Check archive.org

Show headers Download Go to

Full URL

https://alibi44.com/h/superloto/

Requested by

Host: payme.buzz
URL: https://payme.buzz/d/5e4a20bd16b63

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

190.115.27.130 , Belize, ASN262254 (DDOS-GUARD CORP., BZ),

Reverse DNS

ddos-guard.net

Software

ngjit /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=86400

Request headers

:method: GET
:authority: alibi44.com
:scheme: https
:path: /h/superloto/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: __ddg1=Q4PW33ewf0T1z3IYrFAd
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document
Referer: https://payme.buzz/d/5e4a20bd16b63

Response headers

status: 200
server: ngjit
strict-transport-security: max-age=86400
content-security-policy: upgrade-insecure-requests;
date: Sat, 07 Mar 2020 07:15:09 GMT
last-modified: Fri, 28 Feb 2020 22:05:11 GMT
etag: W/"3ab2-59faa080e1523"
accept-ranges: bytes
content-type: text/html
content-encoding: br
vary: Accept-Encoding

Redirect headers

Location: https://alibi44.com/h/superloto/
Non-Authoritative-Reason: HSTS

GET style.css
alibi44.com/h/superloto/css/ 0
0

GET roboto.css
alibi44.com/h/superloto/fonts/Roboto/ 0
0

GET flash.png
alibi44.com/h/superloto/img/ 0
0

GET SuperLoto_Top_02.jpg
alibi44.com/h/superloto/img/ 0
0

GET SuperLoto_Top_02_3-min.png
alibi44.com/h/superloto/img/ 0
0

GET ticket.png
alibi44.com/h/superloto/img/ 0
0

GET security.png
alibi44.com/h/superloto/img/ 0
0

GET loading1.gif
alibi44.com/h/superloto/img/ 0
0

GET loading2.gif
alibi44.com/h/superloto/img/ 0
0

GET ok.png
alibi44.com/h/superloto/img/ 0
0

GET vbr10.png
alibi44.com/h/superloto/img/ 0
0

GET vbr11.png
alibi44.com/h/superloto/img/ 0
0

GET vbr12.png
alibi44.com/h/superloto/img/ 0
0

GET scroll.png
alibi44.com/h/superloto/img/ 0
0

GET vbr1.png
alibi44.com/h/superloto/img/ 0
0

GET vbr2.png
alibi44.com/h/superloto/img/ 0
0

GET vbr3.png
alibi44.com/h/superloto/img/ 0
0

GET vbr4.png
alibi44.com/h/superloto/img/ 0
0

GET vbr5.png
alibi44.com/h/superloto/img/ 0
0

GET vbr6.png
alibi44.com/h/superloto/img/ 0
0

GET vbr7.png
alibi44.com/h/superloto/img/ 0
0

GET vbr8.png
alibi44.com/h/superloto/img/ 0
0

GET vbr9.png
alibi44.com/h/superloto/img/ 0
0

GET vbr13.png
alibi44.com/h/superloto/img/ 0
0

GET soc.png
alibi44.com/h/superloto/img/ 0
0

GET jquery-2.1.4.min.js
alibi44.com/h/superloto/js/ 0
0

GET /
api-maps.yandex.ru/2.0-stable/ 0
0

GET redirect.js
alibi44.com/h/superloto/js/ 0
0

GET messages.js
alibi44.com/h/superloto/js/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: alibi44.com
URL: https://alibi44.com/h/superloto/css/style.css?v=004

Domain: alibi44.com
URL: https://alibi44.com/h/superloto/fonts/Roboto/roboto.css

Domain: alibi44.com
URL: https://alibi44.com/h/superloto/img/flash.png

Domain: alibi44.com
URL: https://alibi44.com/h/superloto/img/SuperLoto_Top_02.jpg

Domain: alibi44.com
URL: https://alibi44.com/h/superloto/img/SuperLoto_Top_02_3-min.png

Domain: alibi44.com
URL: https://alibi44.com/h/superloto/img/ticket.png

Domain: alibi44.com
URL: https://alibi44.com/h/superloto/img/security.png

Domain: alibi44.com
URL: https://alibi44.com/h/superloto/img/loading1.gif

Domain: alibi44.com
URL: https://alibi44.com/h/superloto/img/loading2.gif

Domain: alibi44.com
URL: https://alibi44.com/h/superloto/img/ok.png

Domain: alibi44.com
URL: https://alibi44.com/h/superloto/img/vbr10.png

Domain: alibi44.com
URL: https://alibi44.com/h/superloto/img/vbr11.png

Domain: alibi44.com
URL: https://alibi44.com/h/superloto/img/vbr12.png

Domain: alibi44.com
URL: https://alibi44.com/h/superloto/img/scroll.png

Domain: alibi44.com
URL: https://alibi44.com/h/superloto/img/vbr1.png

Domain: alibi44.com
URL: https://alibi44.com/h/superloto/img/vbr2.png

Domain: alibi44.com
URL: https://alibi44.com/h/superloto/img/vbr3.png

Domain: alibi44.com
URL: https://alibi44.com/h/superloto/img/vbr4.png

Domain: alibi44.com
URL: https://alibi44.com/h/superloto/img/vbr5.png

Domain: alibi44.com
URL: https://alibi44.com/h/superloto/img/vbr6.png

Domain: alibi44.com
URL: https://alibi44.com/h/superloto/img/vbr7.png

Domain: alibi44.com
URL: https://alibi44.com/h/superloto/img/vbr8.png

Domain: alibi44.com
URL: https://alibi44.com/h/superloto/img/vbr9.png

Domain: alibi44.com
URL: https://alibi44.com/h/superloto/img/vbr13.png

Domain: alibi44.com
URL: https://alibi44.com/h/superloto/img/soc.png

Domain: alibi44.com
URL: https://alibi44.com/h/superloto/js/jquery-2.1.4.min.js

Domain: api-maps.yandex.ru
URL: https://api-maps.yandex.ru/2.0-stable/?load=package.standard&lang=ru-RU

Domain: alibi44.com
URL: https://alibi44.com/h/superloto/js/redirect.js

Domain: alibi44.com
URL: https://alibi44.com/h/superloto/js/messages.js?v=005

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

alibi44.com
api-maps.yandex.ru
mybluesky.tv
payme.buzz
alibi44.com
api-maps.yandex.ru
190.115.26.114
190.115.27.130
209.17.116.165
19b2d634386ee866a8eada2d5e2212ed4fd454d91dd5d504fb17f5747310fa22
8304a3a749ff137e5f1cb34936623302b1f032d9a8176d24a6ba0dab2277c4db
af4ac135cf575e46eb783d82f6c659d92afb5e31b647e2ac9d62530c3e371bdb

alibi44.com Open in urlscan Pro 190.115.27.130 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

33 Requests

12 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

31 kBTransfer

44 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

33 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Failed requests

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

0 Cookies

Indicators

alibi44.com Open in urlscan Pro
190.115.27.130 Public Scan

Screenshot
Live screenshot

Full Image

33
Requests

12 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

31 kB
Transfer

44 kB
Size

0
Cookies

33 HTTP transactions
0 data transactions