nullrefer.com - urlscan.io

Summary

This website contacted 4 IPs in 2 countries across 5 domains to perform 5 HTTP transactions. The main IP is 2606:4700:3035::681f:4124, located in United States and belongs to CLOUDFLARENET, US. The main domain is nullrefer.com.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on November 11th 2019. Valid for: a year.

This is the only time nullrefer.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	67.199.248.10 67.199.248.10	396982 (GOOGLE-PR...) (GOOGLE-PRIVATE-CLOUD)
1	2606:4700:303... 2606:4700:3035::681f:4124	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:4104	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	104.20.151.33 104.20.151.33	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	47.74.84.191 47.74.84.191	45102 (CNNIC-ALI...) (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co.)
5	4

1 67.199.248.10 (United States) 1 redirects

ASN396982 (GOOGLE-PRIVATE-CLOUD, US)
PTR: bit.ly

bit.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3035::681f:4124 (United States)

ASN13335 (CLOUDFLARENET, US)

nullrefer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:4104 (United States)

ASN13335 (CLOUDFLARENET, US)

ajax.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.20.151.33 (United States)

ASN13335 (CLOUDFLARENET, US)

secure.statcounter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.statcounter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 47.74.84.191 (Melbourne, Australia)

ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN)

mazobka-812.cf	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	statcounter.com secure.statcounter.com c.statcounter.com	11 KB
1	mazobka-812.cf mazobka-812.cf
1	cloudflare.com ajax.cloudflare.com	4 KB
1	nullrefer.com nullrefer.com	777 B
1	bit.ly 1 redirects bit.ly	295 B
5	5

	Domain	Requested by
1	c.statcounter.com	secure.statcounter.com
1	mazobka-812.cf
1	secure.statcounter.com	ajax.cloudflare.com
1	ajax.cloudflare.com	nullrefer.com
1	nullrefer.com
1	bit.ly	1 redirects
5	6

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2019-11-11` - `2020-10-09`	a year	crt.sh
cloudflare.com CloudFlare Inc ECC CA-2	`2020-01-07` - `2020-10-09`	9 months	crt.sh
us-dallas.statcounter.com Sectigo RSA Domain Validation Secure Server CA	`2019-11-22` - `2020-10-29`	a year	crt.sh
mazobka-812.cf cPanel, Inc. Certification Authority	`2020-03-21` - `2020-06-19`	3 months	crt.sh

This page contains 1 frames:

Frame: https://mazobka-812.cf/PURCHASEORDER.zip
Frame ID: 80D0F37F9A5EF23AB6E188F79DA7CD7F
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://bit.ly/2Ja0Gjf HTTP 301
https://nullrefer.com/?https://mazobka-812.cf/PURCHASEORDER.zip Page URL

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Statcounter (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /statcounter\.com\/counter\/counter/i

Page Statistics

5
Requests

100 %
HTTPS

40 %
IPv6

5
Domains

6
Subdomains

4
IPs

2
Countries

16 kB
Transfer

45 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://bit.ly/2Ja0Gjf HTTP 301
https://nullrefer.com/?https://mazobka-812.cf/PURCHASEORDER.zip Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
nullrefer.com/
Redirect Chain

https://bit.ly/2Ja0Gjf
https://nullrefer.com/?https://mazobka-812.cf/PURCHASEORDER.zip

825 B
777 B

227ms
179ms

Document
text/html

2606:4700:3035::681f:4124
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nullrefer.com/?https://mazobka-812.cf/PURCHASEORDER.zip
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::681f:4124 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/5.3.28
Resource Hash: 53f6be0fc49daa9f0da94596b951be08bc24d3c04b92bc2a93c6c810db93c476

Request headers

:method: GET
:authority: nullrefer.com
:scheme: https
:path: /?https://mazobka-812.cf/PURCHASEORDER.zip
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: document
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document

Response headers

status: 200
date: Mon, 23 Mar 2020 04:09:33 GMT
content-type: text/html
set-cookie: __cfduid=d0613f2bfa2cb29a816c41183e0b1860a1584936573; expires=Wed, 22-Apr-20 04:09:33 GMT; path=/; domain=.nullrefer.com; HttpOnly; SameSite=Lax
x-powered-by: PHP/5.3.28
vary: Accept-Encoding
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 57854c2fcb231f29-FRA
content-encoding: br

Redirect headers

status: 301
server: nginx
date: Mon, 23 Mar 2020 04:09:33 GMT
content-type: text/html; charset=utf-8
content-length: 150
cache-control: private, max-age=90
content-security-policy: referrer always;
location: https://nullrefer.com/?https://mazobka-812.cf/PURCHASEORDER.zip
referrer-policy: unsafe-url
set-cookie: _bit=k2n49x-2cc18ddaa8c99bb647-00R; Domain=bit.ly; Expires=Sat, 19 Sep 2020 04:09:33 GMT
via: 1.1 google
alt-svc: clear

GET
H2 200 rocket-loader.min.js Show response
ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/ 12 KB
4 KB 9ms
7ms Script
application/javascript 2606:4700::6811:4104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js

Requested by

Host: nullrefer.com
URL: https://nullrefer.com/?https://mazobka-812.cf/PURCHASEORDER.zip

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:4104 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b08cdbc2d30e656a86b20f8342428d5863f70f4b30135b4f4061f754ce932f5e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://nullrefer.com/?https://mazobka-812.cf/PURCHASEORDER.zip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 23 Mar 2020 04:09:33 GMT
content-encoding: gzip
vary: Accept-Encoding
last-modified: Tue, 17 Mar 2020 16:29:47 GMT
server: cloudflare
etag: W/"5e70fafb-3016"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
cache-control: max-age=172800, public
strict-transport-security: max-age=15780000; includeSubDomains
cf-ray: 57854c314880175a-FRA
expires: Wed, 25 Mar 2020 04:09:33 GMT

GET
H2 200 counter.js Show response
secure.statcounter.com/counter/ 32 KB
11 KB 74ms
27ms Script
application/x-javascript 104.20.151.33
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.statcounter.com/counter/counter.js
Requested by: Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.151.33 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4af4e87a3c8c8c300d4fb8ffe1627624a8c5463c0d48d3ebb4fcf3ec2da3f7dd

Request headers

Referer: https://nullrefer.com/?https://mazobka-812.cf/PURCHASEORDER.zip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 23 Mar 2020 04:09:33 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 18 Mar 2020 14:45:36 GMT
server: cloudflare
age: 35089
etag: W/"5e723410-7fd3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=43200
cf-ray: 57854c31bffde604-LHR
expires: Mon, 23 Mar 2020 06:24:44 GMT

GET
H/1.1 200
OK PURCHASEORDER.zip
mazobka-812.cf/ 0
0 1017ms
314ms Document
application/zip 47.74.84.191
CNNIC-ALIBABA-US-...

General

Check archive.org

Show headers Download Go to

Full URL: https://mazobka-812.cf/PURCHASEORDER.zip
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 47.74.84.191 Melbourne, Australia, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Host: mazobka-812.cf
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://nullrefer.com/?https://mazobka-812.cf/PURCHASEORDER.zip
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document
Referer: https://nullrefer.com/?https://mazobka-812.cf/PURCHASEORDER.zip

Response headers

Date: Mon, 23 Mar 2020 04:09:34 GMT
Server: Apache
Last-Modified: Mon, 23 Mar 2020 03:22:27 GMT
Accept-Ranges: bytes
Content-Length: 140754
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/zip

POST
H2 200 t.php
c.statcounter.com/ 213 B
409 B 862ms
861ms Other
image/gif 104.20.151.33
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.statcounter.com/t.php?sc_project=11231575&java=1&security=96323b3b&u1=E3EE2AF069D34FE2E97A66EF87BB8116&sc_rum_f_s=0&sc_rum_f_e=590&sc_rum_e_s=591&sc_rum_e_e=595&sc_random=0.6527565601584728&jg=new&rr=1.1.1.1.1.1.1.1.1&resolution=1600&h=1200&camefrom=&u=https%3A//nullrefer.com/%3Fhttps%3A//mazobka-812.cf/PURCHASEORDER.zip&t=Nullrefer.com%20Anonym%20Link&sc_snum=1&sess=5f6681&p=0&invisible=1
Requested by: Host: secure.statcounter.com
URL: https://secure.statcounter.com/counter/counter.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.151.33 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 65ed05ff42beca40792a9581bdf2f97c1bf40a7f417b6dbf79131a650a0c7302

Request headers

Referer: https://nullrefer.com/?https://mazobka-812.cf/PURCHASEORDER.zip
Origin: https://nullrefer.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 23 Mar 2020 04:09:34 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: policyref="http://www.statcounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"
status: 200
cf-ray: 57854c32084be604-LHR
content-type: image/gif
content-length: 213
expires: Mon, 26 Jul 1997 05:00:00 GMT

Verdicts & Comments Add Verdict or Comment

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.nullrefer.com/	1970-01-19 08:58:48	Name: __cfduid Value: d0613f2bfa2cb29a816c41183e0b1860a1584936573

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.cloudflare.com
bit.ly
c.statcounter.com
mazobka-812.cf
nullrefer.com
secure.statcounter.com
104.20.151.33
2606:4700:3035::681f:4124
2606:4700::6811:4104
47.74.84.191
67.199.248.10
4af4e87a3c8c8c300d4fb8ffe1627624a8c5463c0d48d3ebb4fcf3ec2da3f7dd
53f6be0fc49daa9f0da94596b951be08bc24d3c04b92bc2a93c6c810db93c476
65ed05ff42beca40792a9581bdf2f97c1bf40a7f417b6dbf79131a650a0c7302
b08cdbc2d30e656a86b20f8342428d5863f70f4b30135b4f4061f754ce932f5e

nullrefer.com Open in urlscan Pro 2606:4700:3035::681f:4124 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

5 Requests

100 %HTTPS

40 %IPv6

5 Domains

6 Subdomains

4 IPs

2 Countries

16 kBTransfer

45 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

9 JavaScript Global Variables

1 Cookies

Indicators

nullrefer.com Open in urlscan Pro
2606:4700:3035::681f:4124 Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

40 %
IPv6

5
Domains

6
Subdomains

4
IPs

2
Countries

16 kB
Transfer

45 kB
Size

1
Cookies

5 HTTP transactions
0 data transactions