5.9.243.188 Open in urlscan Pro
5.9.243.188 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://5.9.243.188/
Effective URL:
https://5.9.243.188/
Submission: On January 07 via manual (January 7th 2025, 3:14:46 pm UTC) from IL — Scanned from IL

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 2 domains to perform 9 HTTP transactions. The main IP is 5.9.243.188, located in Kandern, Germany and belongs to HETZNER-AS Hetzner Online GmbH, DE. The main domain is 5.9.243.188.
TLS certificate: Issued by R11 on December 13th 2024. Valid for: 3 months.

This is the only time 5.9.243.188 was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
3	5.9.243.188 5.9.243.188	24940 (HETZNER-A...) (HETZNER-AS Hetzner Online GmbH)
1	185.199.110.153 185.199.110.153	54113 (FASTLY) (FASTLY)
4	199.232.188.157 199.232.188.157	54113 (FASTLY) (FASTLY)
1	104.244.42.8 104.244.42.8	13414 (TWITTER) (TWITTER)
9	4

3 5.9.243.188 (Kandern, Germany)

ASN24940 (HETZNER-AS Hetzner Online GmbH, DE)
PTR: cheat.sh

5.9.243.188	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.199.110.153 (United States)

ASN54113 (FASTLY, US)
PTR: cdn-185-199-110-153.github.com

buttons.github.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 199.232.188.157 (Munich, Germany)

ASN54113 (FASTLY, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.8 (United States)

ASN13414 (TWITTER, US)

syndication.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	twitter.com platform.twitter.com — Cisco Umbrella Rank: 1634 syndication.twitter.com — Cisco Umbrella Rank: 2069	30 KB
1	github.io buttons.github.io — Cisco Umbrella Rank: 64479	7 KB
9	2

	Domain	Requested by
4	platform.twitter.com	5.9.243.188 platform.twitter.com
1	syndication.twitter.com
1	buttons.github.io	5.9.243.188
9	3

This site contains no links.

Subject Issuer	Validity	Valid
cheat.sh R11	`2024-12-13` - `2025-03-13`	3 months	crt.sh
*.github.io DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-03-15` - `2025-03-14`	a year	crt.sh
*.twimg.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-06-24` - `2025-07-25`	a year	crt.sh
syndication.twitter.com R10	`2024-12-09` - `2025-03-09`	3 months	crt.sh

This page contains 3 frames:

Primary Page: https://5.9.243.188/
Frame ID: 0A0675AB31E59DBBF6E9DF9E815391AD
Requests: 7 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2F5.9.243.188
Frame ID: 9269CFA13D791EAA49D9FD16263A7947
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/follow_button.2f70fb173b9000da126c79afe2098f02.en.html
Frame ID: 669096BC11750386C3EF26CA5478FAC2
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

cheat.sh/:firstpage

Page URL History Show full URLs

http://5.9.243.188/ HTTP 307
https://5.9.243.188/ Page URL

Detected technologies

Twitter (Widgets) Expand

Overall confidence: 100%
Detected patterns

//platform\.twitter\.com/widgets\.js

Page Statistics

9
Requests

67 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

4
IPs

2
Countries

91 kB
Transfer

590 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://5.9.243.188/ HTTP 307
https://5.9.243.188/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
5.9.243.188/
Redirect Chain

http://5.9.243.188/
https://5.9.243.188/

471 KB
52 KB

965ms
552ms

Document
text/html

5.9.243.188
HETZNER-AS Hetzne...

General

Check archive.org

Show headers Download Go to

Full URL

https://5.9.243.188/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

5.9.243.188 Kandern, Germany, ASN24940 (HETZNER-AS Hetzner Online GmbH, DE),

Reverse DNS

cheat.sh

Software

nginx/1.13.12 /

Resource Hash

1735b5c722636974ebcfce5257f66a0e6829fac17e941a082940fffd96b52623

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=utf-8
Date: Tue, 07 Jan 2025 15:14:41 GMT
Server: nginx/1.13.12
Strict-Transport-Security: max-age=63072000; includeSubdomains
Transfer-Encoding: chunked
X-Content-Type-Options: nosniff
X-Frame-Options: DENY

Redirect headers

Location: https://5.9.243.188/
Non-Authoritative-Reason: HttpsUpgrades

GET
H/1.1 200
OK style.css
5.9.243.188/files/ 625 B
1 KB 203ms
138ms Stylesheet
text/css 5.9.243.188
HETZNER-AS Hetzne...

General

Check archive.org

Show headers Download Go to

Full URL

https://5.9.243.188/files/style.css

Requested by

Host: 5.9.243.188
URL: https://5.9.243.188/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

5.9.243.188 Kandern, Germany, ASN24940 (HETZNER-AS Hetzner Online GmbH, DE),

Reverse DNS

cheat.sh

Software

nginx/1.13.12 /

Resource Hash

4495b3e783509031d4fde3b1a6e55f3c0c8a11394997a330eca526845d7fe66c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://5.9.243.188/

Response headers

Strict-Transport-Security: max-age=63072000; includeSubdomains
Cache-Control: public, max-age=43200
ETag: "1558084977.8329058-625-1443696628"
Connection: keep-alive
X-Content-Type-Options: nosniff
Expires: Wed, 08 Jan 2025 03:14:42 GMT
Content-Length: 625
Date: Tue, 07 Jan 2025 15:14:42 GMT
Content-Type: text/css; charset=utf-8
Last-Modified: Fri, 17 May 2019 09:22:57 GMT
Server: nginx/1.13.12
X-Frame-Options: DENY

GET
H2 200 buttons.js Show response
buttons.github.io/ 19 KB
7 KB 385ms
126ms Script
application/javascript 185.199.110.153
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://buttons.github.io/buttons.js
Requested by: Host: 5.9.243.188
URL: https://5.9.243.188/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.199.110.153 , United States, ASN54113 (FASTLY, US),
Reverse DNS: cdn-185-199-110-153.github.com
Software: GitHub.com /
Resource Hash: eb9dffbab4d4ef9127d97d49b00aba034096ecb1ea18fb98f75b12e6886d802f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://5.9.243.188/

Response headers

x-fastly-request-id: 54c7b19773900e40969f3fbbc9045f7c54715354
content-encoding: gzip
etag: W/"677b8c56-4bf6"
age: 182
x-github-request-id: FBEC:3D14CA:389992:399724:677CADDD
expires: Tue, 07 Jan 2025 04:40:19 GMT
x-proxy-cache: HIT
x-cache: HIT
date: Tue, 07 Jan 2025 15:14:42 GMT
content-type: application/javascript; charset=utf-8
last-modified: Mon, 06 Jan 2025 07:55:02 GMT
x-served-by: cache-fra-eddf8230112-FRA
x-cache-hits: 3
vary: Accept-Encoding
cache-control: max-age=600
x-timer: S1736262882.427153,VS0,VE1
via: 1.1 varnish
permissions-policy: interest-cohort=()
accept-ranges: bytes
access-control-allow-origin: *
content-length: 6701
x-origin-cache: HIT
server: GitHub.com

GET
H2 200 widgets.js Show response
platform.twitter.com/ 91 KB
27 KB 401ms
128ms Script
application/javascript 199.232.188.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: 5.9.243.188
URL: https://5.9.243.188/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 199.232.188.157 Munich, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 173460e89e6a7244218badae2016f65c48a3eae9d400802273eeca18b07336f1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://5.9.243.188/

Response headers

content-encoding: gzip
etag: "824beb891744db98ccbd3a456e59e0f7+gzip"
access-control-allow-methods: GET
x-cache: HIT, HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
date: Tue, 07 Jan 2025 15:14:42 GMT
last-modified: Mon, 11 Dec 2023 17:20:28 GMT
vary: Accept-Encoding
x-served-by: cache-iad-kcgs7200137-IAD, cache-muc13921-MUC
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=1800
tw-cdn: FT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 27597
x-amz-server-side-encryption: AES256

GET
H2 200 widget_iframe.2f70fb173b9000da126c79afe2098f02.html
platform.twitter.com/widgets/ Frame 9269 0
0 372ms
126ms Document
text/html 199.232.188.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2F5.9.243.188
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 199.232.188.157 Munich, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://5.9.243.188/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: public, max-age=315360000
content-encoding: gzip
content-length: 105429
content-type: text/html; charset=utf-8
date: Tue, 07 Jan 2025 15:14:43 GMT
etag: "81267302efdfb3e4524a22631a8fc99e+gzip"
last-modified: Mon, 11 Dec 2023 17:19:49 GMT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
tw-cdn: FT
vary: Accept-Encoding
x-amz-server-side-encryption: AES256
x-cache: HIT, HIT
x-served-by: cache-iad-kiad7000164-IAD, cache-muc13974-MUC

GET
H/1.1 404
NOT FOUND favicon.ico
5.9.243.188/ 232 B
411 B 139ms
138ms Other
text/html 5.9.243.188
HETZNER-AS Hetzne...

General

Check archive.org

Show headers Download Go to

Full URL: https://5.9.243.188/favicon.ico
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 5.9.243.188 Kandern, Germany, ASN24940 (HETZNER-AS Hetzner Online GmbH, DE),
Reverse DNS: cheat.sh
Software: nginx/1.13.12 /
Resource Hash: 9177a352dcbf8875ebb2e22e682760d47faa4d77398add153dd7084e7568c5bc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://5.9.243.188/

Response headers

Transfer-Encoding: chunked
Content-Encoding: gzip
Date: Tue, 07 Jan 2025 15:14:43 GMT
Content-Type: text/html; charset=utf-8
Server: nginx/1.13.12
Connection: keep-alive

GET
H2 200 button.856debeac157d9669cf51e73a08fbc93.js Show response
platform.twitter.com/js/ 8 KB
3 KB 127ms
127ms Script
application/javascript 199.232.188.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/button.856debeac157d9669cf51e73a08fbc93.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 199.232.188.157 Munich, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 426e16d014775c77916610f675f58880874c645817ed26d01873dde3466e6007

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://5.9.243.188/

Response headers

content-encoding: gzip
etag: "fdf02dd038ed38dbf3c240d56262af0c+gzip"
access-control-allow-methods: GET
x-cache: HIT, HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
date: Tue, 07 Jan 2025 15:14:43 GMT
last-modified: Mon, 11 Dec 2023 17:19:47 GMT
vary: Accept-Encoding
x-served-by: cache-iad-kcgs7200086-IAD, cache-muc13921-MUC
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=315360000
tw-cdn: FT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 2620
x-amz-server-side-encryption: AES256

GET
H2 200 follow_button.2f70fb173b9000da126c79afe2098f02.en.html
platform.twitter.com/widgets/ Frame 6690 0
0 126ms
126ms Document
text/html 199.232.188.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/follow_button.2f70fb173b9000da126c79afe2098f02.en.html
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 199.232.188.157 Munich, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://5.9.243.188/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: public, max-age=315360000
content-encoding: gzip
content-length: 13712
content-type: text/html; charset=utf-8
date: Tue, 07 Jan 2025 15:14:44 GMT
etag: "bf4801052efb5f8f12057c849e9b590f+gzip"
last-modified: Mon, 11 Dec 2023 17:19:47 GMT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
tw-cdn: FT
vary: Accept-Encoding
x-amz-server-side-encryption: AES256
x-cache: HIT, HIT
x-served-by: cache-iad-kcgs7200083-IAD, cache-muc13974-MUC

GET
H2 200 embeds
syndication.twitter.com/i/jot/ 43 B
292 B 501ms
243ms Image
image/gif 104.244.42.8
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://syndication.twitter.com/i/jot/embeds?l=%7B%22widget_origin%22%3A%22https%3A%2F%2F5.9.243.188%2F%22%2C%22widget_frame%22%3Afalse%2C%22language%22%3A%22en%22%2C%22message%22%3A%22m%3Awithcount%3A%22%2C%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1736262884101%2C%22dnt%22%3Afalse%2C%22client_version%22%3A%222615f7e52b7e0%3A1702314776716%22%2C%22format_version%22%3A1%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22button%22%2C%22section%22%3A%22follow%22%2C%22action%22%3A%22impression%22%7D%7D&session_id=184456d2c6577a19b318b85a321ce6c3d35e84f5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.8 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_f /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://5.9.243.188/

Response headers

content-type: image/gif
strict-transport-security: max-age=631138519
x-transaction-id: 6596492292fb8de3
cache-control: must-revalidate, max-age=600
x-connection-hash: 55a82ac63aad4eac48ee7f3c2758ebbef0f06e71879835fc228ccda979fde0f2
x-response-time: 114
content-length: 43
date: Tue, 07 Jan 2025 15:14:44 GMT
last-modified: Tue, 07 Jan 2025 15:14:44 GMT
perf: 7402827104
vary: Origin
server: tsa_f

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://5.9.243.188/favicon.ico Message: Failed to load resource: the server responded with a status of 404 (NOT FOUND)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

buttons.github.io
platform.twitter.com
syndication.twitter.com
104.244.42.8
185.199.110.153
199.232.188.157
5.9.243.188
173460e89e6a7244218badae2016f65c48a3eae9d400802273eeca18b07336f1
1735b5c722636974ebcfce5257f66a0e6829fac17e941a082940fffd96b52623
426e16d014775c77916610f675f58880874c645817ed26d01873dde3466e6007
4495b3e783509031d4fde3b1a6e55f3c0c8a11394997a330eca526845d7fe66c
9177a352dcbf8875ebb2e22e682760d47faa4d77398add153dd7084e7568c5bc
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
eb9dffbab4d4ef9127d97d49b00aba034096ecb1ea18fb98f75b12e6886d802f

5.9.243.188 Open in urlscan Pro 5.9.243.188 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

67 %HTTPS

0 %IPv6

2 Domains

3 Subdomains

4 IPs

2 Countries

91 kBTransfer

590 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

0 Cookies

1 Console Messages

Security Headers

Indicators

5.9.243.188 Open in urlscan Pro
5.9.243.188 Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

67 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

4
IPs

2
Countries

91 kB
Transfer

590 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions