URL: https://sonfactory.dk/tramdk.html
Submission: On October 30 via api from BE — Scanned from DE

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 2 HTTP transactions. The main IP is 94.231.103.57, located in Aarhus C, Denmark and belongs to ZITCOM, DK. The main domain is sonfactory.dk.
TLS certificate: Issued by R3 on September 21st 2021. Valid for: 3 months.
This is the only time sonfactory.dk was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 94.231.103.57 48854 (ZITCOM)
1 2606:4700:303... 13335 (CLOUDFLAR...)
2 2
Apex Domain
Subdomains
Transfer
1 1apotekonline.com
1apotekonline.com
98 KB
1 sonfactory.dk
sonfactory.dk
985 B
2 2
Domain Requested by
1 1apotekonline.com sonfactory.dk
1 sonfactory.dk
2 2

This site contains links to these domains. Also see Links.

Domain
topoffers4pills.com
Subject Issuer Validity Valid
sonfactory.dk
R3
2021-09-21 -
2021-12-20
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2021-06-11 -
2022-06-10
a year crt.sh

This page contains 1 frames:

Primary Page: https://sonfactory.dk/tramdk.html
Frame ID: E19DC0C9EC4DBEF1752C387F7A7D50C3
Requests: 2 HTTP requests in this frame

Screenshot

Page Title

Køb Tramadol på nettet uden recept

Page Statistics

2
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

99 kB
Transfer

100 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request tramdk.html
sonfactory.dk/
2 KB
985 B
Document
General
Full URL
https://sonfactory.dk/tramdk.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.231.103.57 Aarhus C, Denmark, ASN48854 (ZITCOM, DK),
Reverse DNS
linux66.unoeuro.com
Software
Apache /
Resource Hash
9a56494db412a9327ea0cb5b49d196a33ad56e9c1e70dbb0ee81ff96edae8a61
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

last-modified
Mon, 11 Oct 2021 16:21:01 GMT
etag
"9a1-5ce161d6a8d25-gzip"
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
x-content-type-options
nosniff
simplycom-server
Apache
content-length
804
content-type
text/html
date
Sat, 30 Oct 2021 01:24:01 GMT
server
Apache
5lrCf.jpg
1apotekonline.com/wp-content/themes/Dansk/img/
97 KB
98 KB
Image
General
Full URL
https://1apotekonline.com/wp-content/themes/Dansk/img/5lrCf.jpg
Requested by
Host: sonfactory.dk
URL: https://sonfactory.dk/tramdk.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::ac43:b1f0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d0c78b27bd4bdc239d0bf4f745db6c16d7e6e0f02b659c00e3c501502390c23a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://sonfactory.dk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sat, 30 Oct 2021 01:24:02 GMT
cf-cache-status
MISS
last-modified
Fri, 11 Mar 2016 19:34:56 GMT
server
cloudflare
etag
"185b5-52dcb069b3800"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Mj3dC2SMQKLAZq%2FlTZ4jUWukG7dIE2jaNdKwxM41sihqOdqLTrPLAkQ2as51YOcZtl3PuSwgi%2BFXV21B00sr61hF3TJ1fptJIgvU379iMwioNxY9aHOyl97wDg42VU3Zn4fmOCoyFyi3tOEGThwWWg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges
bytes
cf-ray
6a60d7770ecb6987-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
99765

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler

0 Cookies

2 Console Messages

Source Level URL
Text
security warning URL: https://sonfactory.dk/tramdk.html
Message:
Mixed Content: The page at 'https://sonfactory.dk/tramdk.html' was loaded over HTTPS, but requested an insecure element 'http://1apotekonline.com/wp-content/themes/Dansk/img/5lrCf.jpg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security warning URL: https://sonfactory.dk/tramdk.html
Message:
Mixed Content: The page at 'https://sonfactory.dk/tramdk.html' was loaded over HTTPS, but requested an insecure element 'http://1apotekonline.com/wp-content/themes/Dansk/img/5lrCf.jpg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1apotekonline.com
sonfactory.dk
2606:4700:3031::ac43:b1f0
94.231.103.57
9a56494db412a9327ea0cb5b49d196a33ad56e9c1e70dbb0ee81ff96edae8a61
d0c78b27bd4bdc239d0bf4f745db6c16d7e6e0f02b659c00e3c501502390c23a