URL: https://runion.su/threads/mask-phishing-urls.3951/
Submission Tags: falconsandbox
Submission: On July 27 via api from US — Scanned from DE

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 14 HTTP transactions. The main IP is 5.42.105.184, located in Russian Federation and belongs to AEZA-AS, GB. The main domain is runion.su.
TLS certificate: Issued by R11 on June 9th 2024. Valid for: 3 months.
This is the only time runion.su was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
14 5.42.105.184 210644 (AEZA-AS)
14 2
Apex Domain
Subdomains
Transfer
14 runion.su
runion.su
632 KB
14 1
Domain Requested by
14 runion.su runion.su
14 1

This site contains links to these domains. Also see Links.

Domain
www.xudongz.com
www.kalilinux.in
Subject Issuer Validity Valid
runion.su
R11
2024-06-09 -
2024-09-07
3 months crt.sh

This page contains 1 frames:

Primary Page: https://runion.su/threads/mask-phishing-urls.3951/
Frame ID: E37D37A11543B5961C125AA064500331
Requests: 15 HTTP requests in this frame

Screenshot

Page Title

Mask Phishing URL's | Runion

Detected technologies

Overall confidence: 100%
Detected patterns

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

14
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

632 kB
Transfer

1264 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
runion.su/threads/mask-phishing-urls.3951/
52 KB
14 KB
Document
General
Full URL
https://runion.su/threads/mask-phishing-urls.3951/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
5.42.105.184 , Russian Federation, ASN210644 (AEZA-AS, GB),
Reverse DNS
lazy-step.aeza.network
Software
nginx/1.24.0 /
Resource Hash
c70e500d63b18289a6905ea66e304fb012e0bc8a93c3b6c9e8750dd16aad01b1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Cache-Control
private, no-cache, max-age=0
Connection
keep-alive
Content-Encoding
gzip
Content-Length
14347
Content-Type
text/html; charset=utf-8
Date
Sat, 27 Jul 2024 03:05:47 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified
Sat, 27 Jul 2024 03:05:47 GMT
Server
nginx/1.24.0
Vary
Accept-Encoding
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
fa-regular-400.woff2
runion.su/styles/fonts/fa/
165 KB
165 KB
Font
General
Full URL
https://runion.su/styles/fonts/fa/fa-regular-400.woff2?_v=5.15.3
Requested by
Host: runion.su
URL: https://runion.su/threads/mask-phishing-urls.3951/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
5.42.105.184 , Russian Federation, ASN210644 (AEZA-AS, GB),
Reverse DNS
lazy-step.aeza.network
Software
nginx/1.24.0 /
Resource Hash
4de49631fe60b17010f7cda29a6236ca6ad6102ea204e5c31d2c1e79ee276938

Request headers

Referer
https://runion.su/threads/mask-phishing-urls.3951/
Origin
https://runion.su
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date
Sat, 27 Jul 2024 03:05:47 GMT
Last-Modified
Sun, 17 Dec 2023 14:43:08 GMT
Server
nginx/1.24.0
ETag
"657f08fc-29340"
Content-Type
font/woff2
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
168768
fa-solid-900.woff2
runion.su/styles/fonts/fa/
134 KB
134 KB
Font
General
Full URL
https://runion.su/styles/fonts/fa/fa-solid-900.woff2?_v=5.15.3
Requested by
Host: runion.su
URL: https://runion.su/threads/mask-phishing-urls.3951/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
5.42.105.184 , Russian Federation, ASN210644 (AEZA-AS, GB),
Reverse DNS
lazy-step.aeza.network
Software
nginx/1.24.0 /
Resource Hash
943efdb4b38963df0653d778f233b55db3e19f44794e4ff944e33b8849dcdb3c

Request headers

Referer
https://runion.su/threads/mask-phishing-urls.3951/
Origin
https://runion.su
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date
Sat, 27 Jul 2024 03:05:47 GMT
Last-Modified
Sun, 17 Dec 2023 14:43:08 GMT
Server
nginx/1.24.0
ETag
"657f08fc-21678"
Content-Type
font/woff2
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
136824
fa-brands-400.woff2
runion.su/styles/fonts/fa/
75 KB
75 KB
Font
General
Full URL
https://runion.su/styles/fonts/fa/fa-brands-400.woff2?_v=5.15.3
Requested by
Host: runion.su
URL: https://runion.su/threads/mask-phishing-urls.3951/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
5.42.105.184 , Russian Federation, ASN210644 (AEZA-AS, GB),
Reverse DNS
lazy-step.aeza.network
Software
nginx/1.24.0 /
Resource Hash
c2497d559960ba9e1c68f41674e8bc980d3b229155e068bc7f42f157f81c4388

Request headers

Referer
https://runion.su/threads/mask-phishing-urls.3951/
Origin
https://runion.su
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date
Sat, 27 Jul 2024 03:05:47 GMT
Last-Modified
Sun, 17 Dec 2023 14:43:08 GMT
Server
nginx/1.24.0
ETag
"657f08fc-12bc4"
Content-Type
font/woff2
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
76740
css.php
runion.su/
393 KB
83 KB
Stylesheet
General
Full URL
https://runion.su/css.php?css=public%3Anormalize.css%2Cpublic%3Afa.css%2Cpublic%3Acore.less%2Cpublic%3Aapp.less&s=2&l=1&d=1721362244&k=ea51f44bc366997dfd2a245e0006363c63dcffa0
Requested by
Host: runion.su
URL: https://runion.su/threads/mask-phishing-urls.3951/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
5.42.105.184 , Russian Federation, ASN210644 (AEZA-AS, GB),
Reverse DNS
lazy-step.aeza.network
Software
nginx/1.24.0 /
Resource Hash
3b79c4c26ab5c03791c19bd1aa894decd50820d8e3abdc5e40c57fa9a1ecd136
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://runion.su/threads/mask-phishing-urls.3951/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date
Sat, 27 Jul 2024 03:05:47 GMT
Content-Encoding
gzip
Last-Modified
Fri, 19 Jul 2024 04:10:44 GMT
Server
nginx/1.24.0
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Content-Type
text/css; charset=utf-8
Cache-Control
public, max-age=31536000
Connection
keep-alive
Content-Length
84375
Expires
Sun, 27 Jul 2025 03:05:47 GMT
css.php
runion.su/
86 KB
20 KB
Stylesheet
General
Full URL
https://runion.su/css.php?css=public%3Amessage.less%2Cpublic%3Ashare_controls.less%2Cpublic%3Aextra.less&s=2&l=1&d=1721362244&k=5d612da5c65a0d1a40b28c361517fb7b695cfd98
Requested by
Host: runion.su
URL: https://runion.su/threads/mask-phishing-urls.3951/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
5.42.105.184 , Russian Federation, ASN210644 (AEZA-AS, GB),
Reverse DNS
lazy-step.aeza.network
Software
nginx/1.24.0 /
Resource Hash
77c56794ec5cbf1a48fa9037bdb853bccebf661413d75f89a8cc2b1ee71f17cf
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://runion.su/threads/mask-phishing-urls.3951/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date
Sat, 27 Jul 2024 03:05:47 GMT
Content-Encoding
gzip
Last-Modified
Fri, 19 Jul 2024 04:10:44 GMT
Server
nginx/1.24.0
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Content-Type
text/css; charset=utf-8
Cache-Control
public, max-age=31536000
Connection
keep-alive
Content-Length
20064
Expires
Sun, 27 Jul 2025 03:05:47 GMT
preamble.min.js
runion.su/js/xf/
4 KB
2 KB
Script
General
Full URL
https://runion.su/js/xf/preamble.min.js?_v=b0759c4a
Requested by
Host: runion.su
URL: https://runion.su/threads/mask-phishing-urls.3951/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
5.42.105.184 , Russian Federation, ASN210644 (AEZA-AS, GB),
Reverse DNS
lazy-step.aeza.network
Software
nginx/1.24.0 /
Resource Hash
304e77733a818935ddeb447ed9d6d6d4f16e44b8cc262ee05c89324ee7afdc6c

Request headers

Referer
https://runion.su/threads/mask-phishing-urls.3951/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date
Sat, 27 Jul 2024 03:05:47 GMT
Content-Encoding
gzip
Last-Modified
Sun, 17 Dec 2023 14:40:04 GMT
Server
nginx/1.24.0
ETag
W/"657f0844-e11"
Transfer-Encoding
chunked
Content-Type
application/javascript; charset=utf-8
Connection
keep-alive
fb32a3d835f249c73bf81.jpg
runion.su/data/assets/logo/
7 KB
7 KB
Image
General
Full URL
https://runion.su/data/assets/logo/fb32a3d835f249c73bf81.jpg
Requested by
Host: runion.su
URL: https://runion.su/threads/mask-phishing-urls.3951/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
5.42.105.184 , Russian Federation, ASN210644 (AEZA-AS, GB),
Reverse DNS
lazy-step.aeza.network
Software
nginx/1.24.0 /
Resource Hash
e6716884368586690c7c2d861b0a3ac01bacf1af2b9c49e44c04eba331a960c2

Request headers

Referer
https://runion.su/threads/mask-phishing-urls.3951/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date
Sat, 27 Jul 2024 03:05:47 GMT
Last-Modified
Wed, 14 Feb 2024 16:10:08 GMT
Server
nginx/1.24.0
ETag
"65cce5e0-1d09"
Content-Type
image/jpeg
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
7433
jquery-3.5.1.min.js
runion.su/js/vendor/jquery/
87 KB
36 KB
Script
General
Full URL
https://runion.su/js/vendor/jquery/jquery-3.5.1.min.js?_v=b0759c4a
Requested by
Host: runion.su
URL: https://runion.su/threads/mask-phishing-urls.3951/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
5.42.105.184 , Russian Federation, ASN210644 (AEZA-AS, GB),
Reverse DNS
lazy-step.aeza.network
Software
nginx/1.24.0 /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

Referer
https://runion.su/threads/mask-phishing-urls.3951/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date
Sat, 27 Jul 2024 03:05:47 GMT
Content-Encoding
gzip
Last-Modified
Sun, 17 Dec 2023 14:39:58 GMT
Server
nginx/1.24.0
ETag
W/"657f083e-15d84"
Transfer-Encoding
chunked
Content-Type
application/javascript; charset=utf-8
Connection
keep-alive
vendor-compiled.js
runion.su/js/vendor/
43 KB
14 KB
Script
General
Full URL
https://runion.su/js/vendor/vendor-compiled.js?_v=b0759c4a
Requested by
Host: runion.su
URL: https://runion.su/threads/mask-phishing-urls.3951/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
5.42.105.184 , Russian Federation, ASN210644 (AEZA-AS, GB),
Reverse DNS
lazy-step.aeza.network
Software
nginx/1.24.0 /
Resource Hash
3507ca14c84cbffccd872e634a84d93f50882c817e66ffdf2643a7ed884a205e

Request headers

Referer
https://runion.su/threads/mask-phishing-urls.3951/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date
Sat, 27 Jul 2024 03:05:47 GMT
Content-Encoding
gzip
Last-Modified
Sun, 17 Dec 2023 14:39:54 GMT
Server
nginx/1.24.0
ETag
W/"657f083a-aab8"
Transfer-Encoding
chunked
Content-Type
application/javascript; charset=utf-8
Connection
keep-alive
core-compiled.js
runion.su/js/xf/
211 KB
74 KB
Script
General
Full URL
https://runion.su/js/xf/core-compiled.js?_v=b0759c4a
Requested by
Host: runion.su
URL: https://runion.su/threads/mask-phishing-urls.3951/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
5.42.105.184 , Russian Federation, ASN210644 (AEZA-AS, GB),
Reverse DNS
lazy-step.aeza.network
Software
nginx/1.24.0 /
Resource Hash
9b3ac0feea940572935c876792af52347e06b26900eb88c4c479448fa319a937

Request headers

Referer
https://runion.su/threads/mask-phishing-urls.3951/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date
Sat, 27 Jul 2024 03:05:48 GMT
Content-Encoding
gzip
Last-Modified
Sun, 17 Dec 2023 14:40:02 GMT
Server
nginx/1.24.0
ETag
W/"657f0842-34af7"
Transfer-Encoding
chunked
Content-Type
application/javascript; charset=utf-8
Connection
keep-alive
1.jpg
runion.su/data/styles/2/styles/xenfocus/uniform/backgrounds/
272 B
272 B
Image
General
Full URL
https://runion.su/data/styles/2/styles/xenfocus/uniform/backgrounds/1.jpg?v=2
Requested by
Host: runion.su
URL: https://runion.su/css.php?css=public%3Amessage.less%2Cpublic%3Ashare_controls.less%2Cpublic%3Aextra.less&s=2&l=1&d=1721362244&k=5d612da5c65a0d1a40b28c361517fb7b695cfd98
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
5.42.105.184 , Russian Federation, ASN210644 (AEZA-AS, GB),
Reverse DNS
lazy-step.aeza.network
Software
nginx/1.24.0 /
Resource Hash
a445d0ce3a2ed07ea76608ba227ee6c2c1be357f571b6ee97432523df10dfaf4

Request headers

Referer
https://runion.su/css.php?css=public%3Amessage.less%2Cpublic%3Ashare_controls.less%2Cpublic%3Aextra.less&s=2&l=1&d=1721362244&k=5d612da5c65a0d1a40b28c361517fb7b695cfd98
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date
Sat, 27 Jul 2024 03:05:48 GMT
Content-Encoding
gzip
Server
nginx/1.24.0
Connection
keep-alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=iso-8859-1
truncated
/
169 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
27026f56a60df83114734de43e8ed2ecbdf62652d315b81556cf798e3c030870

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/svg+xml
5627.jpg
runion.su/data/avatars/m/5/
7 KB
7 KB
Image
General
Full URL
https://runion.su/data/avatars/m/5/5627.jpg?1712582025
Requested by
Host: runion.su
URL: https://runion.su/threads/mask-phishing-urls.3951/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
5.42.105.184 , Russian Federation, ASN210644 (AEZA-AS, GB),
Reverse DNS
lazy-step.aeza.network
Software
nginx/1.24.0 /
Resource Hash
095dbc13c35d9d0ed8849a9d822a148967292b423f1ab8596c61bafd735a93fd

Request headers

Referer
https://runion.su/threads/mask-phishing-urls.3951/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date
Sat, 27 Jul 2024 03:05:48 GMT
Last-Modified
Mon, 08 Apr 2024 13:13:45 GMT
Server
nginx/1.24.0
ETag
"6613ed89-1b46"
Content-Type
image/jpeg
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
6982
favicon.ico
runion.su/
272 B
445 B
Other
General
Full URL
https://runion.su/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
5.42.105.184 , Russian Federation, ASN210644 (AEZA-AS, GB),
Reverse DNS
lazy-step.aeza.network
Software
nginx/1.24.0 /
Resource Hash
a445d0ce3a2ed07ea76608ba227ee6c2c1be357f571b6ee97432523df10dfaf4

Request headers

Referer
https://runion.su/threads/mask-phishing-urls.3951/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date
Sat, 27 Jul 2024 03:05:48 GMT
Content-Encoding
gzip
Server
nginx/1.24.0
Connection
keep-alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| XF object| xfhtml function| applySetting function| $ function| jQuery object| Mustache function| autosize

1 Cookies

Domain/Path Name / Value
runion.su/ Name: xf_csrf
Value: lAOkzHW757gKS8OQ

2 Console Messages

Source Level URL
Text
network error URL: https://runion.su/data/styles/2/styles/xenfocus/uniform/backgrounds/1.jpg?v=2
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: https://runion.su/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN