urlscan.io logo urlscan.io
SecurityTrails logo

www.blog.demo.secure4.happy-day.fun Open in urlscan Pro
185.178.208.169  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.blog.demo.secure4.happy-day.fun/
Submission: On April 05 via automatic, source certstream-suspicious
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 7 IPs in 3 countries across 6 domains to perform 8 HTTP transactions. The main IP is 185.178.208.169, located in Russian Federation and belongs to DDOS-GUARD, RU. The main domain is www.blog.demo.secure4.happy-day.fun.
TLS certificate: Issued by R3 on April 5th 2021. Valid for: 3 months.
This is the only time www.blog.demo.secure4.happy-day.fun was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 185.178.208.169 57724 (DDOS-GUARD)
1 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700:303... 13335 (CLOUDFLAR...)
1 2606:4700:303... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 185.178.208.179 57724 (DDOS-GUARD)
1 185.178.208.154 57724 (DDOS-GUARD)
8 7
2    185.178.208.169 (Russian Federation)

ASN57724 (DDOS-GUARD, RU)
PTR: ddos-guard.net
www.blog.demo.secure4.happy-day.fun
1    2a00:1450:4001:829::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
ajax.googleapis.com
1    2606:4700:3030::ac43:dff3 (United States)

ASN13335 (CLOUDFLARENET, US)
knight-invest.space
1    2606:4700:3036::6815:154b (United States)

ASN13335 (CLOUDFLARENET, US)
business-investment.top
1    2a00:1450:4001:80e::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    185.178.208.179 (Russian Federation)

ASN57724 (DDOS-GUARD, RU)
PTR: ddos-guard.net
cute-fairies.vip
1    185.178.208.154 (Russian Federation)

ASN57724 (DDOS-GUARD, RU)
PTR: ddos-guard.net
techcafe.online
Domain Requested by
2 www.blog.demo.secure4.happy-day.fun www.blog.demo.secure4.happy-day.fun
1 techcafe.online www.blog.demo.secure4.happy-day.fun
1 cute-fairies.vip www.blog.demo.secure4.happy-day.fun
1 fonts.googleapis.com www.blog.demo.secure4.happy-day.fun
1 business-investment.top www.blog.demo.secure4.happy-day.fun
1 knight-invest.space www.blog.demo.secure4.happy-day.fun
1 ajax.googleapis.com www.blog.demo.secure4.happy-day.fun
8 7

This site contains links to these domains. Also see Links.

Domain
knight-invest.space
business-investment.top
happy-day.fun
payeer.com
cute-fairies.vip
techcafe.online
Subject Issuer Validity Valid
blog.demo.secure4.happy-day.fun
R3		 2021-04-05 -
2021-07-04		 3 months crt.sh
upload.video.google.com
GTS CA 1O1		 2021-03-16 -
2021-06-08		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-03-16 -
2022-03-15		 a year crt.sh
cute-fairies.vip
R3		 2021-03-11 -
2021-06-09		 3 months crt.sh
techcafe.online
R3		 2021-03-04 -
2021-06-02		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://www.blog.demo.secure4.happy-day.fun/
Frame ID: 10F8BB91A2CE9D9FBD246EF2786E35F3
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

8
Requests

100 %
HTTPS

57 %
IPv6

6
Domains

7
Subdomains

7
IPs

3
Countries

1284 kB
Transfer

1354 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.blog.demo.secure4.happy-day.fun/ 		17 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.blog.demo.secure4.happy-day.fun/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.178.208.169 , Russian Federation, ASN57724 (DDOS-GUARD, RU),
Reverse DNS
ddos-guard.net
Software
ddos-guard / PHP/5.6.38
Resource Hash
d55c2f6ef8628424d5357ba3b28dccce97ec9fc16bf304dd15de4eece1cd08fb
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;

Request headers

:method
GET
:authority
www.blog.demo.secure4.happy-day.fun
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

server
ddos-guard
content-security-policy
upgrade-insecure-requests;
set-cookie
__ddg1=3dvbFfo91t4vVY5M9sO4; Domain=.happy-day.fun; HttpOnly; Path=/; Expires=Tue, 05-Apr-2022 03:21:29 GMT PHPSESSID=ljfv1o7qstdp5k47hlj8f7vmtl0qmlan; path=/
date
Mon, 05 Apr 2021 03:21:29 GMT
content-type
text/html; charset=windows-1251
x-powered-by
PHP/5.6.38
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma
no-cache
content-encoding
br
vary
Accept-Encoding
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.11.2/ 		94 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/1.11.2/jquery.min.js
Requested by
Host: www.blog.demo.secure4.happy-day.fun
URL: https://www.blog.demo.secure4.happy-day.fun/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2ecd295d295bec062cedebe177e54b9d6b19fc0a841dc5c178c654c9ccff09c0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.blog.demo.secure4.happy-day.fun/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 03 Apr 2021 09:46:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
149672
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
33495
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 03 Apr 2022 09:46:58 GMT
468x60_ru.gif
knight-invest.space/ 		12 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://knight-invest.space/468x60_ru.gif
Requested by
Host: www.blog.demo.secure4.happy-day.fun
URL: https://www.blog.demo.secure4.happy-day.fun/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::ac43:dff3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
224c7aa597fc5b0668fa99c442b5b89b4847242fb9d9c108ad51a9f87bdcee47

Request headers

Referer
https://www.blog.demo.secure4.happy-day.fun/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 05 Apr 2021 03:21:30 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
1583
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
12091
cf-request-id
0941a5cac4000017568529b000000001
last-modified
Tue, 16 Mar 2021 06:05:56 GMT
server
cloudflare
etag
"2f3b-5bda128d53900"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=CvhaCtyx7J3JUMQKCCkVylsD3rWQTcBOLkb5Ang9vtSwoatUT81ngD9bzNPW5hnN42AIlJCpiWWpzsjTXePG5OUHNaLp6nelBgX1QYX7nqGeCpI9woSUIVZ1JhZF1Uu7"}]}
content-type
image/gif
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
63afa58ad9c61756-FRA
468x60_ru.gif
business-investment.top/ 		131 KB
132 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://business-investment.top/468x60_ru.gif
Requested by
Host: www.blog.demo.secure4.happy-day.fun
URL: https://www.blog.demo.secure4.happy-day.fun/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::6815:154b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3d2eebac3858f03807ea6c4fc943ebe52c0c0b05db63bf147c12dc77c05ec91b

Request headers

Referer
https://www.blog.demo.secure4.happy-day.fun/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 05 Apr 2021 03:21:30 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
6000
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
134589
cf-request-id
0941a5caee00004ec71b128000000001
last-modified
Sun, 14 Mar 2021 11:17:45 GMT
server
cloudflare
etag
"20dbd-5bd7d484b2840"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=SBwLRXdANmAtA8TU8K%2Fyw%2F%2F3sx6yxJpx5WkyZSo1rixbfAFGf%2FRbSwgShn%2Bq8dYhpMClJ3DIYQvqdVvUjzFT5Jt0nInTtN3J%2F52F71QfR%2F%2Buyr2TRQzfKgNSKWN7NjKNWjD9oQ%3D%3D"}],"group":"cf-nel"}
content-type
image/gif
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
63afa58b1feb4ec7-FRA
css
fonts.googleapis.com/ 		381 B
400 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Luckiest+Guy
Requested by
Host: www.blog.demo.secure4.happy-day.fun
URL: https://www.blog.demo.secure4.happy-day.fun/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
e13957e14c0168914edf08bb14c2143a3786b66915296e346ecae686486c4aad
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Mon, 05 Apr 2021 03:13:35 GMT
server
ESF
date
Mon, 05 Apr 2021 03:21:30 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 05 Apr 2021 03:21:30 GMT
fon.jpg
www.blog.demo.secure4.happy-day.fun/img/ 		953 KB
955 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.blog.demo.secure4.happy-day.fun/img/fon.jpg
Requested by
Host: www.blog.demo.secure4.happy-day.fun
URL: https://www.blog.demo.secure4.happy-day.fun/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.178.208.169 , Russian Federation, ASN57724 (DDOS-GUARD, RU),
Reverse DNS
ddos-guard.net
Software
ddos-guard /
Resource Hash
69a81872d95b75578c9c50ebf41a08c2e1c5282e12ff0840be074b9c18655355
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;

Request headers

Referer
https://www.blog.demo.secure4.happy-day.fun/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests;
last-modified
Wed, 05 Aug 2020 11:31:53 GMT
server
ddos-guard
age
0
etag
"ee5bf-5ac1fb7f19791"
content-type
image/jpeg
date
Mon, 05 Apr 2021 03:21:30 GMT
accept-ranges
bytes
content-length
976319
468x60_en.gif
cute-fairies.vip/ 		118 KB
118 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cute-fairies.vip/468x60_en.gif
Requested by
Host: www.blog.demo.secure4.happy-day.fun
URL: https://www.blog.demo.secure4.happy-day.fun/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.178.208.179 , Russian Federation, ASN57724 (DDOS-GUARD, RU),
Reverse DNS
ddos-guard.net
Software
ddos-guard /
Resource Hash
8d8369eb70bad6ba34ff9cfa5259bc21efdd86cfc642e21c5281fabb6627e5d7
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;

Request headers

Referer
https://www.blog.demo.secure4.happy-day.fun/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests;
last-modified
Thu, 11 Mar 2021 12:54:33 GMT
server
ddos-guard
age
19064
etag
"1d6b8-5bd4248f41440"
content-type
image/gif
date
Sun, 04 Apr 2021 22:03:45 GMT
accept-ranges
bytes
content-length
120504
468x60_en.gif
techcafe.online/ 		28 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://techcafe.online/468x60_en.gif
Requested by
Host: www.blog.demo.secure4.happy-day.fun
URL: https://www.blog.demo.secure4.happy-day.fun/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.178.208.154 , Russian Federation, ASN57724 (DDOS-GUARD, RU),
Reverse DNS
ddos-guard.net
Software
ddos-guard /
Resource Hash
72ef9de92c6a1995310dc93c7fdc21cc74638e88aa4786b467a46998c1859682
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;

Request headers

Referer
https://www.blog.demo.secure4.happy-day.fun/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests;
last-modified
Mon, 23 Nov 2020 17:19:41 GMT
server
ddos-guard
age
49702
etag
"7062-5b4c966486540"
content-type
image/gif
date
Sun, 04 Apr 2021 13:33:08 GMT
accept-ranges
bytes
content-length
28770

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery

2 Cookies

Domain/Path Name / Value
www.blog.demo.secure4.happy-day.fun/ Name: PHPSESSID
Value: ljfv1o7qstdp5k47hlj8f7vmtl0qmlan
.happy-day.fun/ Name: __ddg1
Value: 3dvbFfo91t4vVY5M9sO4

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests;