afarm.net - urlscan.io

Summary

This website contacted 2 IPs in 3 countries across 3 domains to perform 3 HTTP transactions. The main IP is 193.3.19.64, located in Russian Federation and belongs to SELECTEL-MSK, RU. The main domain is afarm.net.
TLS certificate: Issued by R3 on May 8th 2024. Valid for: 3 months.

This is the only time afarm.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Downloads These files were downloaded by the website

08-May-24-document-3910f164.jar 29 KB application/java-archive

SHA256: f20585b7183d6380968b8f1d75a34bb78b6224e5686ebb81430ec14e80fce17a

MIME: Java archive data (JAR)

Size: 29 KB (29570 bytes, 100% done)

Downloaded from: https://moarhofhechtl.at/wp-content/plugins/image-hover-effects-addon-for-elementor/download.php

Domain & IP information

	IP Address	AS Autonomous System
2	193.3.19.64 193.3.19.64	50340 (SELECTEL-MSK) (SELECTEL-MSK)
1 1	45.61.138.43 45.61.138.43	399629 (BLNWX) (BLNWX)
1	192.36.38.142 192.36.38.142	57169 (EDIS-AS-EU) (EDIS-AS-EU)
3	2

2 193.3.19.64 (Russian Federation)

ASN50340 (SELECTEL-MSK, RU)

afarm.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 45.61.138.43 (London, United Kingdom) 1 redirects

ASN399629 (BLNWX, US)

wercosliuhqgheirn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.36.38.142 (Sweden)

ASN57169 (EDIS-AS-EU, AT)
PTR: p42.internetsuccess.at

moarhofhechtl.at	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	afarm.net afarm.net	702 B
1	moarhofhechtl.at moarhofhechtl.at
1	wercosliuhqgheirn.com 1 redirects wercosliuhqgheirn.com	774 B
3	3

	Domain	Requested by
2	afarm.net
1	moarhofhechtl.at
1	wercosliuhqgheirn.com	1 redirects
3	3

This site contains no links.

Subject Issuer	Validity	Valid
adztrk.com R3	`2024-05-08` - `2024-08-06`	3 months	crt.sh
moarhofhechtl.at R3	`2024-03-24` - `2024-06-22`	3 months	crt.sh

This page contains 1 frames:

Frame: https://moarhofhechtl.at/wp-content/plugins/image-hover-effects-addon-for-elementor/download.php
Frame ID: D88CEDB7B9D89A367B19382233BFF210
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Page Statistics

3
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

1 kB
Transfer

0 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://wercosliuhqgheirn.com/ HTTP 302
https://moarhofhechtl.at/wp-content/plugins/image-hover-effects-addon-for-elementor/download.php

3 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 404
Not Found Primary Request uvz2q Show response
afarm.net/ 71 B
351 B 920ms
337ms Document
text/html 193.3.19.64
SELECTEL-MSK

General

Check archive.org

Show headers Download Go to

Full URL: https://afarm.net/uvz2q
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.3.19.64 , Russian Federation, ASN50340 (SELECTEL-MSK, RU),
Reverse DNS
Software: nginx /
Resource Hash: 1e467dbe3baad0a6b18452bccc65d2228e55ef3d969db1dfb191e282a904ef6d

Request headers

Accept-Language: en-CA,en;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Length: 71
Content-Type: text/html; charset=UTF-8
Date: Thu, 09 May 2024 09:16:01 GMT
ETag: "47-617f220359aa3"
Keep-Alive: timeout=60
Last-Modified: Wed, 08 May 2024 14:29:10 GMT
Server: nginx

GET
H/1.1

200
OK

download.php
moarhofhechtl.at/wp-content/plugins/image-hover-effects-addon-for-elementor/
Redirect Chain

https://wercosliuhqgheirn.com/
https://moarhofhechtl.at/wp-content/plugins/image-hover-effects-addon-for-elementor/download.php

0
0

909ms
214ms

Document
application/java-archive

192.36.38.142
EDIS-AS-EU

General

Check archive.org

Show headers Download Go to

Full URL

https://moarhofhechtl.at/wp-content/plugins/image-hover-effects-addon-for-elementor/download.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.36.38.142 , Sweden, ASN57169 (EDIS-AS-EU, AT),

Reverse DNS

p42.internetsuccess.at

Software

Apache/2.4.10 (Debian) /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: en-CA,en;q=0.9;q=0.9
Referer: https://afarm.net/uvz2q
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Cache-Control: must-revalidate
Connection: Keep-Alive
Content-Description: File Transfer
Content-Disposition: attachment; filename="08-May-24-document-3910f164.jar"
Content-Length: 29570
Content-Type: application/java-archive
Date: Thu, 09 May 2024 09:16:03 GMT
Expires: 0
Keep-Alive: timeout=10, max=200
Pragma: public
Server: Apache/2.4.10 (Debian)
Strict-Transport-Security: max-age=0

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Content-Type: text/html; charset=utf-8
Date: Thu, 09 May 2024 09:16:02 GMT
Expires: Thu, 09 May 2024 09:16:02 GMT
Location: https://moarhofhechtl.at/wp-content/plugins/image-hover-effects-addon-for-elementor/download.php
Server: nginx/1.22.1
Vary: Accept-Encoding

GET
H/1.1 404
Not Found favicon.ico
afarm.net/ 71 B
351 B 204ms
204ms Other
text/html 193.3.19.64
SELECTEL-MSK

General

Check archive.org

Show headers Download Go to

Full URL: https://afarm.net/favicon.ico
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.3.19.64 , Russian Federation, ASN50340 (SELECTEL-MSK, RU),
Reverse DNS
Software: nginx /
Resource Hash: 1e467dbe3baad0a6b18452bccc65d2228e55ef3d969db1dfb191e282a904ef6d

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://afarm.net/uvz2q
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 09 May 2024 09:16:01 GMT
Last-Modified: Wed, 08 May 2024 14:29:10 GMT
Server: nginx
ETag: "47-617f220359aa3"
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=60
Content-Length: 71

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			wercosliuhqgheirn.com/	1970-01-20 21:12:04	Name: _subid Value: 1dkuhrk43pd
			wercosliuhqgheirn.com/	1970-01-21 06:03:26	Name: ec9cc Value: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjVcIjoxNzE1MjQ2MTYyfSxcImNhbXBhaWduc1wiOntcIjNcIjoxNzE1MjQ2MTYyfSxcInRpbWVcIjoxNzE1MjQ2MTYyfSJ9.kIe0y4FabSkvPsjZkIa5kZ7UoZA1b7Wh04yVzEwPcDQ

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://afarm.net/uvz2q Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://afarm.net/favicon.ico Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

afarm.net
moarhofhechtl.at
wercosliuhqgheirn.com
192.36.38.142
193.3.19.64
45.61.138.43
1e467dbe3baad0a6b18452bccc65d2228e55ef3d969db1dfb191e282a904ef6d

afarm.net Open in urlscan Pro 193.3.19.64 Public Scan

Summary

urlscan.io Verdict: No classification

Downloads These files were downloaded by the website

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

3 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

2 IPs

3 Countries

1 kBTransfer

0 kBSize

2 Cookies

0 Outgoing links

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

2 Cookies

2 Console Messages

Indicators

afarm.net Open in urlscan Pro
193.3.19.64 Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

1 kB
Transfer

0 kB
Size

2
Cookies

3 HTTP transactions
0 data transactions