garglingirony.com - urlscan.io

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 4 HTTP transactions. The main IP is 192.243.59.12, located in Ashburn, United States and belongs to ADVANCEDHOSTERS-AS, NL. The main domain is garglingirony.com. The Cisco Umbrella rank of the primary domain is 249709.
TLS certificate: Issued by R3 on March 22nd 2022. Valid for: 3 months.

This is the only time garglingirony.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	2606:4700:303... 2606:4700:3036::ac43:c677	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	2a02:6b8::1:119 2a02:6b8::1:119	208722 (YNDX) (YNDX)
1	192.243.59.12 192.243.59.12	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
4	3

2 2606:4700:3036::ac43:c677 (United States)

ASN13335 (CLOUDFLARENET, US)

mainclick.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:6b8::1:119 (Moscow, Russian Federation) 1 redirects

ASN208722 (YNDX, FI)

mc.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.243.59.12 (Ashburn, United States)

ASN39572 (ADVANCEDHOSTERS-AS, NL)

garglingirony.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	yandex.ru 1 redirects mc.yandex.ru — Cisco Umbrella Rank: 2877	917 B
2	mainclick.xyz mainclick.xyz — Cisco Umbrella Rank: 212937	2 KB
1	garglingirony.com garglingirony.com — Cisco Umbrella Rank: 249709	778 B
4	3

	Domain	Requested by
2	mc.yandex.ru	1 redirects
2	mainclick.xyz	mainclick.xyz
1	garglingirony.com	mainclick.xyz
4	3

This site contains links to these domains. Also see Links.

Domain
highperformancedformats.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-03-31` - `2023-03-30`	a year	crt.sh
garglingirony.com R3	`2022-03-22` - `2022-06-20`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://garglingirony.com/p332ib12t?key=8646f06bbf07b62ce686a9f3542d0ce7&psid=ahvp_90_484
Frame ID: 1B0ACE436B2A3584C82889239D1B8E12
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://mainclick.xyz/worker/direct?zid=484 Page URL
https://garglingirony.com/p332ib12t?key=8646f06bbf07b62ce686a9f3542d0ce7&psid=ahvp_90_484 Page URL

Page Statistics

4
Requests

75 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

2 kB
Transfer

2 kB
Size

6
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: http://highperformancedformats.com/anonymous/
Title: Anonymous Proxy detected, click here.

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://mainclick.xyz/worker/direct?zid=484 Page URL
https://garglingirony.com/p332ib12t?key=8646f06bbf07b62ce686a9f3542d0ce7&psid=ahvp_90_484 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

https://mc.yandex.ru/watch/88055619 HTTP 302
https://mc.yandex.ru/watch/88055619/1

4 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 direct
mainclick.xyz/worker/ 356 B
771 B 141ms
81ms Document
text/html 2606:4700:3036::ac43:c677
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mainclick.xyz/worker/direct?zid=484
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:c677 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 6fbb8511ba4e0e16-MXP
content-encoding: br
content-type: text/html; charset=utf-8
date: Thu, 14 Apr 2022 09:47:23 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8VdWzjT%2BV2UkyK4hElSu8%2BIoqDbB3HTdex8npK3nNWQcMZiFwG7BQOGGiEfikQpoL4i1nCZ7A%2Bg3qlxgtW5d95KN%2FTafixoJbYBEFW6WNQM99E6d8%2Bu5dnKKXmBTpHdbtBLQKIuMHocFsG5i"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express

GET
H2

200

1
mc.yandex.ru/watch/88055619/
Redirect Chain

https://mc.yandex.ru/watch/88055619
https://mc.yandex.ru/watch/88055619/1

43 B
164 B

39ms
38ms

Image
image/gif

2a02:6b8::1:119
YNDX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.ru/watch/88055619/1

Protocol

H2

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

/

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mainclick.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 14 Apr 2022 09:47:24 GMT
last-modified: Thu, 14-Apr-2022 09:47:24 GMT
strict-transport-security: max-age=31536000
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
content-length: 43
x-xss-protection: 1; mode=block
expires: Thu, 14-Apr-2022 09:47:24 GMT

Redirect headers

pragma: no-cache
date: Thu, 14 Apr 2022 09:47:23 GMT
last-modified: Thu, 14-Apr-2022 09:47:23 GMT
strict-transport-security: max-age=31536000
location: /watch/88055619/1
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
x-xss-protection: 1; mode=block
expires: Thu, 14-Apr-2022 09:47:23 GMT

GET
H2 200 app.js
mainclick.xyz/worker/ 1 KB
838 B 53ms
52ms Script
text/javascript 2606:4700:3036::ac43:c677
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mainclick.xyz/worker/app.js
Requested by: Host: mainclick.xyz
URL: https://mainclick.xyz/worker/direct?zid=484
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:c677 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mainclick.xyz/worker/direct?zid=484
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Thu, 14 Apr 2022 09:47:23 GMT
content-encoding: br
etag: W/"599-+h+ebGFoUvrjq2a49e414zCuePs"
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 928
x-powered-by: Express
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7PyHI3LcZ4C3SNONIej2mM7QFJae%2F9LxaF5KvJafYz4sS8nVQAckzbKxWDz7%2B5BFQVz0vabG0xcl24C5UoMhwMG0PFWifF%2Fcz6kKIMpj%2B94c0RDEcmKX2Y5YOG1ug5tUu6demm01xOrGFZM5"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript; charset=utf-8
cache-control: max-age=14400
cf-ray: 6fbb85128bd40e16-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H/1.1 200
OK Primary Request p332ib12t Show response
garglingirony.com/ 115 B
778 B 564ms
104ms Document
text/html 192.243.59.12
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://garglingirony.com/p332ib12t?key=8646f06bbf07b62ce686a9f3542d0ce7&psid=ahvp_90_484

Requested by

Host: mainclick.xyz
URL: https://mainclick.xyz/worker/app.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.243.59.12 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),

Reverse DNS

Software

nginx/1.17.6 /

Resource Hash

f28ce5befe08ed90a2e12b6b2a5e9fdafaa6ad173503079155260aa480c66590

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubdomains

Request headers

Referer: https://mainclick.xyz/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformSec-CH-UA-Platform-Version,User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA,x-Device-User-Agent
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 115
Content-Type: text/html
Date: Thu, 14 Apr 2022 09:47:24 GMT
Expires: Thu, 01 Jan 1970 00:00:01 GMT
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Server: nginx/1.17.6
Strict-Transport-Security: max-age=0; includeSubdomains
X-Request-ID: 396db2ec1e123629396293f3766e4c55

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored function| getScreenDetails

6 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.yandex.ru/	1970-01-20 11:04:25	Name: yandexuid Value: 9506034621649929643
.yandex.ru/	1970-01-20 11:04:25	Name: yuidss Value: 9506034621649929643
mc.yandex.ru/	1969-12-31 23:59:59	Name: yabs-sid Value: 2295276121649929643
.yandex.ru/	1970-01-23 17:54:49	Name: i Value: ZjD7vzP2iXltVS2B5IYOl3d0wkROd+gEpmlv6bC1FpHJQgsJwy7+2ePL2MIHY4VTTqAE82IAXy3kTIrzLHK5qRHb9CI=
.yandex.ru/	1970-01-20 11:04:25	Name: ymex Value: 1681465643.yrts.1649929643#1681465643.yrtsi.1649929643
garglingirony.com/	1970-01-20 02:20:16	Name: u_pl Value: 17050081

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

garglingirony.com
mainclick.xyz
mc.yandex.ru
192.243.59.12
2606:4700:3036::ac43:c677
2a02:6b8::1:119
f28ce5befe08ed90a2e12b6b2a5e9fdafaa6ad173503079155260aa480c66590

garglingirony.com Open in urlscan Pro 192.243.59.12 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

4 Requests

75 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

2 kBTransfer

2 kBSize

6 Cookies

1 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

6 Cookies

Indicators

garglingirony.com Open in urlscan Pro
192.243.59.12 Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

75 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

2 kB
Transfer

2 kB
Size

6
Cookies

4 HTTP transactions
0 data transactions