urlscan.io logo urlscan.io
SecurityTrails logo

xn--80aaaddbv1bzakhzkdlc.xn--p1ai Open in urlscan Pro Puny
установкавебасто.рф IDN
87.236.16.73  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://dhltaichung.pages.dev/dhluk
Effective URL: https://xn--80aaaddbv1bzakhzkdlc.xn--p1ai/wp-content/plugins/security/skymit/index.html
Submission: On July 31 via api from BE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main IP is 87.236.16.73, located in St Petersburg, Russian Federation and belongs to BEGET-AS, RU. The main domain is xn--80aaaddbv1bzakhzkdlc.xn--p1ai.
TLS certificate: Issued by R11 on June 16th 2024. Valid for: 3 months.
This is the only time xn--80aaaddbv1bzakhzkdlc.xn--p1ai was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 172.66.44.143 13335 (CLOUDFLAR...)
3 87.236.16.73 198610 (BEGET-AS)
5 2
Apex Domain
Subdomains		 Transfer
3
function sub() { [native code] }.
787 KB
2 pages.dev
dhltaichung.pages.dev
1 KB
5 2
Domain Requested by
3 xn--80aaaddbv1bzakhzkdlc.xn--p1ai xn--80aaaddbv1bzakhzkdlc.xn--p1ai
2 dhltaichung.pages.dev
5 2

This site contains no links.

Subject Issuer Validity Valid
dhltaichung.pages.dev
WE1		 2024-07-27 -
2024-10-25		 3 months crt.sh
xn--80aaaddbv1bzakhzkdlc.xn--p1ai
R11		 2024-06-16 -
2024-09-14		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://xn--80aaaddbv1bzakhzkdlc.xn--p1ai/wp-content/plugins/security/skymit/index.html
Frame ID: 8BEFBF5D2138114FFFB4F1B8DE08B7BC
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://dhltaichung.pages.dev/dhluk Page URL
  2. https://xn--80aaaddbv1bzakhzkdlc.xn--p1ai/wp-content/plugins/security/skymit/index.html Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/

Page Statistics

5
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

788 kB
Transfer

792 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://dhltaichung.pages.dev/dhluk Page URL
  2. https://xn--80aaaddbv1bzakhzkdlc.xn--p1ai/wp-content/plugins/security/skymit/index.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
dhluk
dhltaichung.pages.dev/ 		382 B
704 B 		Document
General
Check archive.org
Download Go to
Full URL
https://dhltaichung.pages.dev/dhluk
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.44.143 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
cache-control
public, max-age=0, must-revalidate
cf-ray
8ac113dd7b2991e9-FRA
content-encoding
br
content-type
text/html; charset=utf-8
date
Wed, 31 Jul 2024 22:38:14 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I2VDXsroh9GY5T0TJT9EPqGZA5jFfoPkyTixa6w28vJOzpCspIPfzcYefTaIIrV84nvnTsvig5x8Vrs%2F5zoFVlG337QjyUiiRj8jksPUGSDvHk%2B1JFBYKqj1dXNGXrgdlDuaPequ6p8%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-content-type-options
nosniff
Primary Request index.html
xn--80aaaddbv1bzakhzkdlc.xn--p1ai/wp-content/plugins/security/skymit/ 		8 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://xn--80aaaddbv1bzakhzkdlc.xn--p1ai/wp-content/plugins/security/skymit/index.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
87.236.16.73 St Petersburg, Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS
ssl.venom.beget.com
Software
nginx-reuseport/1.21.1 /
Resource Hash
7facb0e5fea2d13ddb7c1b2234828754d30f36f76e7a8f0d7c263bc6d5e077a1

Request headers

Referer
https://dhltaichung.pages.dev/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-encoding
gzip
content-type
text/html
date
Wed, 31 Jul 2024 22:38:15 GMT
etag
W/"2013-60efcbb0cf540"
last-modified
Mon, 15 Jan 2024 14:21:33 GMT
server
nginx-reuseport/1.21.1
vary
Accept-Encoding
favicon.ico
dhltaichung.pages.dev/ 		0
414 B 		Other
General
Check archive.org
Download Go to
Full URL
https://dhltaichung.pages.dev/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.44.143 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://dhltaichung.pages.dev/dhluk
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Wed, 31 Jul 2024 22:38:14 GMT
referrer-policy
strict-origin-when-cross-origin
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q2jIupWx0KsmU20Z1GtemTHnCuII8vu6udPRmo9b9Cglqkt0l1jgM%2Fk8E45NyU2S7ZMCeuWtn9%2FeghDLZO2WCS0TXIBTfOjeaXcBuYpzYw4jg9jpxX0pjJKd%2FRFO9u1M9tQD%2BAxYeOU%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
cache-control
no-store
cf-ray
8ac113de4bd291e9-FRA
alt-svc
h3=":443"; ma=86400
content-length
0
bg.png
xn--80aaaddbv1bzakhzkdlc.xn--p1ai/wp-content/plugins/security/skymit/includes/ 		779 KB
780 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://xn--80aaaddbv1bzakhzkdlc.xn--p1ai/wp-content/plugins/security/skymit/includes/bg.png
Requested by
Host: xn--80aaaddbv1bzakhzkdlc.xn--p1ai
URL: https://xn--80aaaddbv1bzakhzkdlc.xn--p1ai/wp-content/plugins/security/skymit/index.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
87.236.16.73 St Petersburg, Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS
ssl.venom.beget.com
Software
nginx-reuseport/1.21.1 /
Resource Hash
22d4eaf583654561667bbe962901ff99f37e29c1e95baabb70a89601594609c9

Request headers

Referer
https://xn--80aaaddbv1bzakhzkdlc.xn--p1ai/wp-content/plugins/security/skymit/index.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Wed, 31 Jul 2024 22:38:15 GMT
last-modified
Mon, 15 Jan 2024 14:05:37 GMT
server
nginx-reuseport/1.21.1
etag
"65a53bb1-c2db9"
content-type
image/png
cache-control
max-age=2592000
accept-ranges
bytes
content-length
798137
expires
Fri, 30 Aug 2024 22:38:15 GMT
favicon.ico
xn--80aaaddbv1bzakhzkdlc.xn--p1ai/ 		4 KB
4 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://xn--80aaaddbv1bzakhzkdlc.xn--p1ai/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
87.236.16.73 St Petersburg, Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS
ssl.venom.beget.com
Software
nginx-reuseport/1.21.1 /
Resource Hash
e139ce6794f4225a5e303685bea0bd4fc56bbc1a2e253ae5638da0c5031dc459

Request headers

Referer
https://xn--80aaaddbv1bzakhzkdlc.xn--p1ai/wp-content/plugins/security/skymit/index.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Wed, 31 Jul 2024 22:38:17 GMT
last-modified
Thu, 18 Apr 2024 16:12:24 GMT
server
nginx-reuseport/1.21.1
accept-ranges
bytes
etag
"1071-616613c906a00"
content-length
4209
content-type
text/html

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| e1427d97e string| k function| l1ee9c function| ed85d96066

0 Cookies

2 Console Messages

Source Level URL
Text
network error URL: https://dhltaichung.pages.dev/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 ()
recommendation verbose URL: https://xn--80aaaddbv1bzakhzkdlc.xn--p1ai/wp-content/plugins/security/skymit/index.html
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

dhltaichung.pages.dev
xn--80aaaddbv1bzakhzkdlc.xn--p1ai
172.66.44.143
87.236.16.73
22d4eaf583654561667bbe962901ff99f37e29c1e95baabb70a89601594609c9
7facb0e5fea2d13ddb7c1b2234828754d30f36f76e7a8f0d7c263bc6d5e077a1
e139ce6794f4225a5e303685bea0bd4fc56bbc1a2e253ae5638da0c5031dc459