urlscan.io logo urlscan.io
SecurityTrails logo

biggerpicture.g2afse.com Open in urlscan Pro
213.227.156.13  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://zzupkjgttd.duc.kdns.org/login.php
Effective URL: https://biggerpicture.g2afse.com/disabled.html
Submission Tags: krdprod
Submission: On November 05 via api from JP — Scanned from JP
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 3 HTTP transactions. The main IP is 213.227.156.13, located in Netherlands and belongs to LEASEWEB-NL-AMS-01 Netherlands, NL. The main domain is biggerpicture.g2afse.com.
TLS certificate: Issued by DigiCert TLS Hybrid ECC SHA384 2020 CA1 on August 5th 2021. Valid for: a year.
This is the only time biggerpicture.g2afse.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 2607:fad0:380... 32244 (LIQUIDWEB)
1 1 198.134.116.30 27257 (WEBAIR-IN...)
3 4 213.227.156.13 60781 (LEASEWEB-...)
3 2
Apex Domain
Subdomains		 Transfer
4 g2afse.com
biggerpicture.g2afse.com
799 B
2 kdns.org
zzupkjgttd.duc.kdns.org
3 KB
1 expmediadirect1.com
click.expmediadirect1.com
282 B
3 3
Domain Requested by
4 biggerpicture.g2afse.com 3 redirects zzupkjgttd.duc.kdns.org
2 zzupkjgttd.duc.kdns.org zzupkjgttd.duc.kdns.org
1 click.expmediadirect1.com 1 redirects
3 3

This site contains no links.

Subject Issuer Validity Valid
centos7.template.liquidweb.com
centos7.template.liquidweb.com		 2017-03-02 -
2018-03-02		 a year crt.sh
*.g2afse.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2021-08-05 -
2022-09-03		 a year crt.sh

This page contains 1 frames:

Primary Page: https://biggerpicture.g2afse.com/disabled.html
Frame ID: 3FC170CDDD53FFF4A9DA4F4B0E6AF540
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Disabled

Page URL History Show full URLs

  1. https://zzupkjgttd.duc.kdns.org/login.php Page URL
  2. https://zzupkjgttd.duc.kdns.org/page/bouncy.php?&bpae=GbhGd60molx7j3MVBrdsPtYU%2FHNqbA4wwgwWVZIGo7V50xQcF74P... Page URL
  3. https://click.expmediadirect1.com/click?i=FrisxE3T4HE_0 HTTP 302
    http://biggerpicture.g2afse.com/sl?id=5dca95883bf47917e8f2530d&pid=112&sub5=[conversion]&sub1=[source] HTTP 302
    https://biggerpicture.g2afse.com/sl?id=5dca95883bf47917e8f2530d&pid=112&sub5=[conversion]&sub1=[source] HTTP 302
    http://biggerpicture.g2afse.com/disabled.html HTTP 302
    https://biggerpicture.g2afse.com/disabled.html Page URL

Page Statistics

3
Requests

33 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

3 kB
Transfer

3 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://zzupkjgttd.duc.kdns.org/login.php Page URL
  2. https://zzupkjgttd.duc.kdns.org/page/bouncy.php?&bpae=GbhGd60molx7j3MVBrdsPtYU%2FHNqbA4wwgwWVZIGo7V50xQcF74Pe6BnO0%2B4A81S5SwnijaobSrQCymE9ylhH8jukG3osGmbfKlp2i6lIjyOe%2BZC%2FLm%2BvK55h2eqtLfuWDp7TjUvjOSy8frP7c3%2B94lJC7Bxz0tUh4uERydZ4%2BNCM4NP0JYvC1FgfyZO1KgGJabn5%2FhpbJrqqJQK7Hk5ZxTRSHFbDBMB47SC9OQGgXrQXWjWUNKgHH8DTRRL%2BLQuv1OcJgCSRdXRaItvIU29brNY0%2BqqbB%2BcTJecx3lDGtCPtdCYwLX8Qc4dpACpwY9tFhQt2aaW9utKa4qB3tPUA1990cQLp93WqaG1RwDl55cjY%2F1m0Rj01h4bzNm0ypAR0OurMFqePmU9n5oETBGlCbzWqU4VMNQ%2B&redirectType=js&inIframe=false&inPopUp=false Page URL
  3. https://click.expmediadirect1.com/click?i=FrisxE3T4HE_0 HTTP 302
    http://biggerpicture.g2afse.com/sl?id=5dca95883bf47917e8f2530d&pid=112&sub5=[conversion]&sub1=[source] HTTP 302
    https://biggerpicture.g2afse.com/sl?id=5dca95883bf47917e8f2530d&pid=112&sub5=[conversion]&sub1=[source] HTTP 302
    http://biggerpicture.g2afse.com/disabled.html HTTP 302
    https://biggerpicture.g2afse.com/disabled.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
login.php
zzupkjgttd.duc.kdns.org/ 		2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://zzupkjgttd.duc.kdns.org/login.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2607:fad0:3801:4::1 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
Software
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 / PHP/5.4.16
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
jp-JP,jp;q=0.9

Response headers

Date
Fri, 05 Nov 2021 06:41:07 GMT
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9
X-Powered-By
PHP/5.4.16
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
bouncy.php
zzupkjgttd.duc.kdns.org/page/ 		691 B
975 B 		Document
General
Check archive.org
Download Go to
Full URL
https://zzupkjgttd.duc.kdns.org/page/bouncy.php?&bpae=GbhGd60molx7j3MVBrdsPtYU%2FHNqbA4wwgwWVZIGo7V50xQcF74Pe6BnO0%2B4A81S5SwnijaobSrQCymE9ylhH8jukG3osGmbfKlp2i6lIjyOe%2BZC%2FLm%2BvK55h2eqtLfuWDp7TjUvjOSy8frP7c3%2B94lJC7Bxz0tUh4uERydZ4%2BNCM4NP0JYvC1FgfyZO1KgGJabn5%2FhpbJrqqJQK7Hk5ZxTRSHFbDBMB47SC9OQGgXrQXWjWUNKgHH8DTRRL%2BLQuv1OcJgCSRdXRaItvIU29brNY0%2BqqbB%2BcTJecx3lDGtCPtdCYwLX8Qc4dpACpwY9tFhQt2aaW9utKa4qB3tPUA1990cQLp93WqaG1RwDl55cjY%2F1m0Rj01h4bzNm0ypAR0OurMFqePmU9n5oETBGlCbzWqU4VMNQ%2B&redirectType=js&inIframe=false&inPopUp=false
Requested by
Host: zzupkjgttd.duc.kdns.org
URL: https://zzupkjgttd.duc.kdns.org/login.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2607:fad0:3801:4::1 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
Software
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 / PHP/5.4.16
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
jp-JP,jp;q=0.9
Referer
https://zzupkjgttd.duc.kdns.org/login.php

Response headers

Date
Fri, 05 Nov 2021 06:41:08 GMT
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9
X-Powered-By
PHP/5.4.16
Keep-Alive
timeout=5, max=99
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Primary Request disabled.html
biggerpicture.g2afse.com/
Redirect Chain
  • https://click.expmediadirect1.com/click?i=FrisxE3T4HE_0
  • http://biggerpicture.g2afse.com/sl?id=5dca95883bf47917e8f2530d&pid=112&sub5=[conversion]&sub1=[source]
  • https://biggerpicture.g2afse.com/sl?id=5dca95883bf47917e8f2530d&pid=112&sub5=[conversion]&sub1=[source]
  • http://biggerpicture.g2afse.com/disabled.html
  • https://biggerpicture.g2afse.com/disabled.html
111 B
209 B 		Document
General
Check archive.org
Download Go to
Full URL
https://biggerpicture.g2afse.com/disabled.html
Requested by
Host: zzupkjgttd.duc.kdns.org
URL: https://zzupkjgttd.duc.kdns.org/page/bouncy.php?&bpae=GbhGd60molx7j3MVBrdsPtYU%2FHNqbA4wwgwWVZIGo7V50xQcF74Pe6BnO0%2B4A81S5SwnijaobSrQCymE9ylhH8jukG3osGmbfKlp2i6lIjyOe%2BZC%2FLm%2BvK55h2eqtLfuWDp7TjUvjOSy8frP7c3%2B94lJC7Bxz0tUh4uERydZ4%2BNCM4NP0JYvC1FgfyZO1KgGJabn5%2FhpbJrqqJQK7Hk5ZxTRSHFbDBMB47SC9OQGgXrQXWjWUNKgHH8DTRRL%2BLQuv1OcJgCSRdXRaItvIU29brNY0%2BqqbB%2BcTJecx3lDGtCPtdCYwLX8Qc4dpACpwY9tFhQt2aaW9utKa4qB3tPUA1990cQLp93WqaG1RwDl55cjY%2F1m0Rj01h4bzNm0ypAR0OurMFqePmU9n5oETBGlCbzWqU4VMNQ%2B&redirectType=js&inIframe=false&inPopUp=false
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
213.227.156.13 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software
nginx /
Resource Hash
b7413baf6c8d815f06ac626010aa7c4eff83b4f3ab3fa3cfd4c50cb533b5cf08

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
jp-JP,jp;q=0.9
Referer
https://zzupkjgttd.duc.kdns.org/page/bouncy.php?&bpae=GbhGd60molx7j3MVBrdsPtYU%2FHNqbA4wwgwWVZIGo7V50xQcF74Pe6BnO0%2B4A81S5SwnijaobSrQCymE9ylhH8jukG3osGmbfKlp2i6lIjyOe%2BZC%2FLm%2BvK55h2eqtLfuWDp7TjUvjOSy8frP7c3%2B94lJC7Bxz0tUh4uERydZ4%2BNCM4NP0JYvC1FgfyZO1KgGJabn5%2FhpbJrqqJQK7Hk5ZxTRSHFbDBMB47SC9OQGgXrQXWjWUNKgHH8DTRRL%2BLQuv1OcJgCSRdXRaItvIU29brNY0%2BqqbB%2BcTJecx3lDGtCPtdCYwLX8Qc4dpACpwY9tFhQt2aaW9utKa4qB3tPUA1990cQLp93WqaG1RwDl55cjY%2F1m0Rj01h4bzNm0ypAR0OurMFqePmU9n5oETBGlCbzWqU4VMNQ%2B&redirectType=js&inIframe=false&inPopUp=false

Response headers

server
nginx
date
Fri, 05 Nov 2021 06:41:10 GMT
content-type
text/html
last-modified
Sat, 17 Aug 2019 06:59:30 GMT
etag
W/"5d57a5d2-6f"
content-encoding
gzip

Redirect headers

Server
nginx
Date
Fri, 05 Nov 2021 06:41:10 GMT
Content-Type
text/html
Content-Length
138
Connection
keep-alive
Location
https://biggerpicture.g2afse.com/disabled.html

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

biggerpicture.g2afse.com
click.expmediadirect1.com
zzupkjgttd.duc.kdns.org
198.134.116.30
213.227.156.13
2607:fad0:3801:4::1
b7413baf6c8d815f06ac626010aa7c4eff83b4f3ab3fa3cfd4c50cb533b5cf08