active11it.top - urlscan.io

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 3 HTTP transactions. The main IP is 2606:4700:30::681b:b6a8, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is active11it.top.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on April 3rd 2019. Valid for: a year.

This is the only time active11it.top was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 2	2606:4700:30:... 2606:4700:30::681b:b7a8	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 2	2606:4700:30:... 2606:4700:30::681b:b6a8	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2	188.68.32.154 188.68.32.154	197540 (NETCUP-AS...) (NETCUP-AS netcup GmbH)
3	2

2 2606:4700:30::681b:b7a8 (United States) 2 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

active11it.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:30::681b:b6a8 (United States) 1 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

active11it.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 188.68.32.154 (Germany)

ASN197540 (NETCUP-AS netcup GmbH, DE)
PTR: mrburns.daasrv.net

hub.daa.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	active11it.top 3 redirects active11it.top	1 KB
2	daa.net hub.daa.net	11 KB
3	2

	Domain	Requested by
4	active11it.top	3 redirects
2	hub.daa.net	active11it.top hub.daa.net
3	2

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2019-04-03` - `2020-04-03`	a year	crt.sh
www.heizungsfinder.de GlobalSign Organization Validation CA - SHA256 - G2	`2016-10-17` - `2019-10-18`	3 years	crt.sh

This page contains 2 frames:

Primary Page: https://active11it.top/warmewellenheizung/u8h8e3r4/order.php
Frame ID: F95F5649171E0D1B9FA579D485B37A09
Requests: 2 HTTP requests in this frame

Frame: https://hub.daa.net/embed/05c699a1b065b6dd5136a0383eec73fc
Frame ID: 897BCA21CD6B988681ED703B25F72811
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://active11it.top/warmewellenheizung/u8h8e3r4/?l=372329&t=2&a=2666632785&e=bewerbung@tki-autom... HTTP 301
https://active11it.top/warmewellenheizung/u8h8e3r4/?l=372329&t=2&a=2666632785&e=bewerbung@tki-autom... HTTP 302
http://active11it.top/warmewellenheizung/u8h8e3r4/order.php HTTP 301
https://active11it.top/warmewellenheizung/u8h8e3r4/order.php Page URL

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /cloudflare/i

Page Statistics

3
Requests

100 %
HTTPS

67 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

11 kB
Transfer

30 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://active11it.top/warmewellenheizung/u8h8e3r4/?l=372329&t=2&a=2666632785&e=bewerbung@tki-automotive.de%3E HTTP 301
https://active11it.top/warmewellenheizung/u8h8e3r4/?l=372329&t=2&a=2666632785&e=bewerbung@tki-automotive.de%3E HTTP 302
http://active11it.top/warmewellenheizung/u8h8e3r4/order.php HTTP 301
https://active11it.top/warmewellenheizung/u8h8e3r4/order.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request order.php Show response
active11it.top/warmewellenheizung/u8h8e3r4/
Redirect Chain

http://active11it.top/warmewellenheizung/u8h8e3r4/?l=372329&t=2&a=2666632785&e=bewerbung@tki-automotive.de%3E
https://active11it.top/warmewellenheizung/u8h8e3r4/?l=372329&t=2&a=2666632785&e=bewerbung@tki-automotive.de%3E
http://active11it.top/warmewellenheizung/u8h8e3r4/order.php
https://active11it.top/warmewellenheizung/u8h8e3r4/order.php

122 B
154 B

41ms
40ms

Document
text/html

2606:4700:30::681b:b6a8
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://active11it.top/warmewellenheizung/u8h8e3r4/order.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:b6a8 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cc77b97eb8c7b9314dab6bb206faf9311e7d852f0315cc9333783a208ef736a0

Request headers

:method: GET
:authority: active11it.top
:scheme: https
:path: /warmewellenheizung/u8h8e3r4/order.php
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding: gzip, deflate, br
cookie: __cfduid=d465c77d04f6120b43f780754a98683711554449039
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 200
date: Fri, 05 Apr 2019 07:23:59 GMT
content-type: text/html
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 4c29c7a0887e641b-FRA
content-encoding: br

Redirect headers

Date: Fri, 05 Apr 2019 07:23:59 GMT
Content-Type: text/html; charset=iso-8859-1
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d465c77d04f6120b43f780754a98683711554449039; expires=Sat, 04-Apr-20 07:23:59 GMT; path=/; domain=.active11it.top; HttpOnly
Location: https://active11it.top/warmewellenheizung/u8h8e3r4/order.php
Server: cloudflare
CF-RAY: 4c29c7a06bffc2bf-FRA

GET
H/1.1 200
OK hub.js Show response
hub.daa.net/js/ 30 KB
11 KB 85ms
19ms Script
application/javascript 188.68.32.154
NETCUP-AS netcup ...

General

Check archive.org

Show headers Download Go to

Full URL

https://hub.daa.net/js/hub.js

Requested by

Host: active11it.top
URL: https://active11it.top/warmewellenheizung/u8h8e3r4/order.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

188.68.32.154 , Germany, ASN197540 (NETCUP-AS netcup GmbH, DE),

Reverse DNS

mrburns.daasrv.net

Software

Apache /

Resource Hash

4bfce2cd6203fe3126386ee1aed40f5179908b319c3a375b93561dae606b96f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400;
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

Referer: https://active11it.top/warmewellenheizung/u8h8e3r4/order.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Fri, 05 Apr 2019 07:23:59 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Connection: Keep-Alive
Content-Length: 10496
X-XSS-Protection: 1
Last-Modified: Wed, 03 Apr 2019 10:48:37 GMT
Server: Apache
ETag: "783c-5859dfeef2b40-gzip"
Vary: Accept-Encoding
Strict-Transport-Security: max-age=86400;
Content-Type: application/javascript
Cache-Control: max-age=2592000
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Expires: Sun, 05 May 2019 07:23:59 GMT

GET
H/1.1 200
OK 05c699a1b065b6dd5136a0383eec73fc
hub.daa.net/embed/ Frame 897B 0
0 51ms
46ms Document
text/html 188.68.32.154
NETCUP-AS netcup ...

General

Check archive.org

Show headers Download Go to

Full URL

https://hub.daa.net/embed/05c699a1b065b6dd5136a0383eec73fc

Requested by

Host: hub.daa.net
URL: https://hub.daa.net/js/hub.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

188.68.32.154 , Germany, ASN197540 (NETCUP-AS netcup GmbH, DE),

Reverse DNS

mrburns.daasrv.net

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400;
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

Host: hub.daa.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: https://active11it.top/warmewellenheizung/u8h8e3r4/order.php
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://active11it.top/warmewellenheizung/u8h8e3r4/order.php

Response headers

Date: Fri, 05 Apr 2019 07:23:59 GMT
Server: Apache
Cache-Control: no-cache, private
Strict-Transport-Security: max-age=86400;
Vary: Accept-Encoding
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-XSS-Protection: 1
Content-Length: 3356
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.active11it.top/	1970-01-19 08:33:05	Name: __cfduid Value: d465c77d04f6120b43f780754a98683711554449039

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

active11it.top
hub.daa.net
188.68.32.154
2606:4700:30::681b:b6a8
2606:4700:30::681b:b7a8
4bfce2cd6203fe3126386ee1aed40f5179908b319c3a375b93561dae606b96f9
cc77b97eb8c7b9314dab6bb206faf9311e7d852f0315cc9333783a208ef736a0

active11it.top Open in urlscan Pro 2606:4700:30::681b:b6a8 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

3 Requests

100 %HTTPS

67 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

11 kBTransfer

30 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

1 Cookies

Indicators

active11it.top Open in urlscan Pro
2606:4700:30::681b:b6a8 Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

100 %
HTTPS

67 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

11 kB
Transfer

30 kB
Size

1
Cookies

3 HTTP transactions
0 data transactions