3f.rs - urlscan.io

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 5 HTTP transactions. The main IP is 94.130.237.5, located in Tübingen, Germany and belongs to HETZNER-AS, DE. The main domain is 3f.rs.
TLS certificate: Issued by R3 on March 27th 2024. Valid for: 3 months.

This is the only time 3f.rs was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	94.130.237.5 94.130.237.5	24940 (HETZNER-AS) (HETZNER-AS)
2	2606:4700:e6:... 2606:4700:e6::ac40:ce26	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.67.129.133 172.67.129.133	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	4

2 94.130.237.5 (Tübingen, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: host37.dwhost.net

3f.rs	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:e6::ac40:ce26 (United States)

ASN13335 (CLOUDFLARENET, US)

use.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.129.133 (United States)

ASN13335 (CLOUDFLARENET, US)

www.dreamwebhosting.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	fontawesome.com use.fontawesome.com — Cisco Umbrella Rank: 1203	59 KB
2	3f.rs 3f.rs	17 KB
1	dreamwebhosting.net www.dreamwebhosting.net	14 KB
5	3

	Domain	Requested by
2	use.fontawesome.com	3f.rs use.fontawesome.com
2	3f.rs
1	www.dreamwebhosting.net	3f.rs
5	3

This site contains links to these domains. Also see Links.

Domain
www.dreamwebhosting.net

Subject Issuer	Validity	Valid
*.3f.rs R3	`2024-03-27` - `2024-06-25`	3 months	crt.sh
use.fontawesome.com Cloudflare Inc ECC CA-3	`2023-10-12` - `2024-10-10`	a year	crt.sh
dreamwebhosting.net E1	`2024-02-14` - `2024-05-14`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://3f.rs/wp1/wp-includes/wlwmanifest.xml
Frame ID: 1D2A181648F612FBA27F0F950614B3F2
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Site Closed

Page URL History Show full URLs

http://3f.rs/wp1/wp-includes/wlwmanifest.xml HTTP 307
https://3f.rs/wp1/wp-includes/wlwmanifest.xml Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Page Statistics

5
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

90 kB
Transfer

123 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: http://www.dreamwebhosting.net/
Title: Hosted by DreamWeb

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://3f.rs/wp1/wp-includes/wlwmanifest.xml HTTP 307
https://3f.rs/wp1/wp-includes/wlwmanifest.xml Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

503

Primary Request wlwmanifest.xml Show response
3f.rs/wp1/wp-includes/
Redirect Chain

http://3f.rs/wp1/wp-includes/wlwmanifest.xml
https://3f.rs/wp1/wp-includes/wlwmanifest.xml

8 KB
9 KB

819ms
316ms

Document
text/html

94.130.237.5
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://3f.rs/wp1/wp-includes/wlwmanifest.xml
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 94.130.237.5 Tübingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: host37.dwhost.net
Software: Apache /
Resource Hash: 017de920d4ce5a97ea56690662d29a450a42efcd8062274900f47eda8889b212

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: no-cache, no-store, must-revalidate
content-length: 8581
content-type: text/html
date: Wed, 03 Apr 2024 20:41:07 GMT
expires: 0
last-modified: Mon, 26 Sep 2022 11:53:09 GMT
pragma: no-cache
server: Apache

Redirect headers

Location: https://3f.rs/wp1/wp-includes/wlwmanifest.xml
Non-Authoritative-Reason: HttpsUpgrades

GET
H2 200 all.css
use.fontawesome.com/releases/v5.0.13/css/ 40 KB
9 KB 124ms
46ms Stylesheet
text/css 2606:4700:e6::ac40:ce26
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.0.13/css/all.css
Requested by: Host: 3f.rs
URL: https://3f.rs/wp1/wp-includes/wlwmanifest.xml
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:ce26 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 43730866612149a27f49159d7c4f19185c8694bb91bf41abc884a6fe1346e96e

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://3f.rs/
Origin: https://3f.rs
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Apr 2024 20:41:07 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 22 Sep 2023 01:44:09 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 341961
etag: W/"d61bfe9b56c13ecff5313ee3abb45e8b"
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1sNF2P8xm%2FycgLToqjpqWFfmvlQZUZuhhlX2XyYKYHZfnl5LjPSmQjmFr%2BNUtomxq2CQ%2FAodFKWlXYsVz3js5DCvOX0KRITb0cYXxDuym85rWDqA9JlX9sD0wZbk3S41KA0QvehZYSWDUzkX%2BSaUG%2Frj"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
cf-ray: 86ebe0ad5bc767c2-MIA
alt-svc: h3=":443"; ma=86400

GET
H3 200 dreamwebhosting-logo-centered.png
www.dreamwebhosting.net/images/ 14 KB
14 KB 126ms
45ms Image
image/png 172.67.129.133
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.dreamwebhosting.net/images/dreamwebhosting-logo-centered.png

Requested by

Host: 3f.rs
URL: https://3f.rs/wp1/wp-includes/wlwmanifest.xml

Protocol

H3

Security

QUIC, , AES_128_GCM

Server

172.67.129.133 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b5f24c17a4de6550a636139322b898744af13814946f6055f40436d23caa407c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'; report-uri https://7r41y7nb.uriports.com/reports/report;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://3f.rs/
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Apr 2024 20:41:07 GMT
content-security-policy: frame-ancestors 'self'; report-uri https://7r41y7nb.uriports.com/reports/report;
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"default","max_age":2592000,"include_subdomains":true,"failure_fraction":1.0}
age: 5947
alt-svc: h3=":443"; ma=86400
content-length: 14108
x-xss-protection: 1; mode=block
last-modified: Wed, 16 Jul 2014 20:29:52 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
report-to: {"group":"default","max_age":10886400,"endpoints":[{"url":"https://7r41y7nb.uriports.com/reports"}],"include_subdomains":true}
content-type: image/png
vary: Accept-Encoding
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 86ebe0ad6f647486-MIA

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bf54538a1951e9e4ed0b407ffbed2583fd441fcc087da5c6657a0cde6d0c0208

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 fa-solid-900.woff2
use.fontawesome.com/releases/v5.0.13/webfonts/ 49 KB
50 KB 223ms
223ms Font
font/woff2 2606:4700:e6::ac40:ce26
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.0.13/webfonts/fa-solid-900.woff2
Requested by: Host: use.fontawesome.com
URL: https://use.fontawesome.com/releases/v5.0.13/css/all.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:ce26 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cbbca7d9888b4a9eab7d479756d2924f9b067fd38dab376797029df741f96ee4

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://use.fontawesome.com/releases/v5.0.13/css/all.css
Origin: https://3f.rs
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Apr 2024 20:41:07 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 0
alt-svc: h3=":443"; ma=86400
content-length: 50372
last-modified: Fri, 22 Sep 2023 01:44:10 GMT
server: cloudflare
etag: "8a8c0474283e0d9ef41743e5e486bf05"
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=m1GIkxY2m1BM%2F%2BNkuOUmzLMOoWflR9SuEn88Gbk0NHR5HyUGg97%2BhIUnkK%2Fnmka%2FmP6vOy8ahc6tqHhaMTV0NXC84%2FpTgSt6Sg4DePEVlXFYW4Hb5JDPvuZXVOCcSDBT6T%2Bp72gMSILrlynVvXG1H0Ae"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 86ebe0adbc6967c2-MIA

GET
H2 503 favicon.ico
3f.rs/ 8 KB
8 KB 186ms
186ms Other
text/html 94.130.237.5
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://3f.rs/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 94.130.237.5 Tübingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: host37.dwhost.net
Software: Apache /
Resource Hash: 017de920d4ce5a97ea56690662d29a450a42efcd8062274900f47eda8889b212

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://3f.rs/wp1/wp-includes/wlwmanifest.xml
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 03 Apr 2024 20:41:07 GMT
last-modified: Mon, 26 Sep 2022 11:53:09 GMT
server: Apache
content-type: text/html
cache-control: no-cache, no-store, must-revalidate
accept-ranges: bytes
content-length: 8581
expires: 0

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://3f.rs/wp1/wp-includes/wlwmanifest.xml Message: Failed to load resource: the server responded with a status of 503 ()
network	error	URL: https://3f.rs/favicon.ico Message: Failed to load resource: the server responded with a status of 503 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3f.rs
use.fontawesome.com
www.dreamwebhosting.net
172.67.129.133
2606:4700:e6::ac40:ce26
94.130.237.5
017de920d4ce5a97ea56690662d29a450a42efcd8062274900f47eda8889b212
43730866612149a27f49159d7c4f19185c8694bb91bf41abc884a6fe1346e96e
b5f24c17a4de6550a636139322b898744af13814946f6055f40436d23caa407c
bf54538a1951e9e4ed0b407ffbed2583fd441fcc087da5c6657a0cde6d0c0208
cbbca7d9888b4a9eab7d479756d2924f9b067fd38dab376797029df741f96ee4

3f.rs Open in urlscan Pro 94.130.237.5 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

5 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

4 IPs

2 Countries

90 kBTransfer

123 kBSize

0 Cookies

1 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

3f.rs Open in urlscan Pro
94.130.237.5 Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

90 kB
Transfer

123 kB
Size

0
Cookies

5 HTTP transactions
1 data transactions