icloud-web.ir Open in urlscan Pro
136.243.52.8 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://icloud-web.ir/
Submission Tags: @phishunt_io
Submission: On December 26 via api (December 26th 2020, 8:57:59 pm UTC) from ES

Summary HTTP 7 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 7 HTTP transactions. The main IP is 136.243.52.8, located in Germany and belongs to HETZNER-AS, DE. The main domain is icloud-web.ir.
TLS certificate: Issued by R3 on December 26th 2020. Valid for: 3 months.

This is the only time icloud-web.ir was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
6	136.243.52.8 136.243.52.8		24940 (HETZNER-AS) (HETZNER-AS)
1	2a00:1450:400... 2a00:1450:4001:81a::200a		15169 (GOOGLE) (GOOGLE)
7	2

6 136.243.52.8 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: nova3.euhosted.com

icloud-web.ir	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
clickdomain.ir	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81a::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	clickdomain.ir clickdomain.ir	66 KB
1	googleapis.com ajax.googleapis.com	33 KB
1	icloud-web.ir icloud-web.ir	1 KB
7	3

	Domain	Requested by
5	clickdomain.ir	icloud-web.ir
1	ajax.googleapis.com	icloud-web.ir
1	icloud-web.ir
7	3

This site contains no links.

Subject Issuer	Validity	Valid
backup-service.ir R3	`2020-12-26` - `2021-03-26`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2020-11-10` - `2021-02-02`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://icloud-web.ir/
Frame ID: 3209D6EBF0273649BCA1A8FC260B88ED
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i

LiteSpeed (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^LiteSpeed$/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

7
Requests

86 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

101 kB
Transfer

202 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
icloud-web.ir/ 4 KB
1 KB 573ms
524ms Document
text/html 136.243.52.8
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://icloud-web.ir/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 136.243.52.8 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: nova3.euhosted.com
Software: LiteSpeed /
Resource Hash: b8369e3565aa5f03588d51251e341fe4a5de1ec396d552d8fc374fdf317f40d3

Request headers

:method: GET
:authority: icloud-web.ir
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-litespeed-cache-control: no-cache
content-type: text/html; charset=UTF-8
cache-control: public, max-age=0
expires: Sat, 26 Dec 2020 20:57:40 GMT
content-length: 1450
content-encoding: br
vary: Accept-Encoding,User-Agent
date: Sat, 26 Dec 2020 20:57:40 GMT
server: LiteSpeed

GET
H2 200 font-awesome.min.css
clickdomain.ir/wp-content/themes/flozen-theme/assets/font-awesome-4.7.0/css/ 30 KB
7 KB 36ms
34ms Stylesheet
text/css 136.243.52.8
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://clickdomain.ir/wp-content/themes/flozen-theme/assets/font-awesome-4.7.0/css/font-awesome.min.css
Requested by: Host: icloud-web.ir
URL: https://icloud-web.ir/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 136.243.52.8 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: nova3.euhosted.com
Software: LiteSpeed /
Resource Hash: 4686b37aaeb9d1f68992a44ba58e2eec3cbb0abfd36ed2f08cfd9c7b5ecabb4f

Request headers

Referer: https://icloud-web.ir/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Dec 2020 20:57:40 GMT
content-encoding: br
last-modified: Wed, 09 Sep 2020 18:19:53 GMT
server: LiteSpeed
vary: Accept-Encoding,User-Agent
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 6677
expires: Sun, 26 Dec 2021 20:57:40 GMT

GET
H2 200 NS-Custom-Font.css
clickdomain.ir/wp-content/themes/flozen-theme/assets/font-nasa-custom/ 2 KB
462 B 38ms
36ms Stylesheet
text/css 136.243.52.8
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://clickdomain.ir/wp-content/themes/flozen-theme/assets/font-nasa-custom/NS-Custom-Font.css
Requested by: Host: icloud-web.ir
URL: https://icloud-web.ir/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 136.243.52.8 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: nova3.euhosted.com
Software: LiteSpeed /
Resource Hash: f666cc34637b3dc4c487b69b2ed5fd5702c0fede8c3a7a651551531c2dc34046

Request headers

Referer: https://icloud-web.ir/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Dec 2020 20:57:40 GMT
content-encoding: br
last-modified: Sun, 13 Sep 2020 18:38:37 GMT
server: LiteSpeed
vary: Accept-Encoding,User-Agent
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 410
expires: Sun, 26 Dec 2021 20:57:40 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.12.4/ 95 KB
33 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:81a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js

Requested by

Host: icloud-web.ir
URL: https://icloud-web.ir/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://icloud-web.ir/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 23 Dec 2020 15:39:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 278293
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33951
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 23 Dec 2021 15:39:27 GMT

GET
H/1.1 200
OK commingsoon.jpg
clickdomain.ir/wp-content/uploads/2020/09/ 54 KB
54 KB 34ms
33ms Image
image/jpeg 136.243.52.8
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://clickdomain.ir/wp-content/uploads/2020/09/commingsoon.jpg
Requested by: Host: icloud-web.ir
URL: https://icloud-web.ir/
Protocol: HTTP/1.1
Server: 136.243.52.8 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: nova3.euhosted.com
Software: LiteSpeed /
Resource Hash: d3af0ecd9370da8f1d228c0c983a5de151a0339fa9a1f5e6f8364f6b69ab625d

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 26 Dec 2020 20:57:40 GMT
Last-Modified: Fri, 25 Sep 2020 13:54:49 GMT
Server: LiteSpeed
Vary: User-Agent
Content-Type: image/jpeg
Cache-Control: public, max-age=31536000,public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 54858
Expires: Sun, 26 Dec 2021 20:57:40 GMT

GET
H2 200 countdown.min.js Show response
clickdomain.ir/wp-content/themes/flozen-theme/assets/js/min/ 16 KB
5 KB 34ms
33ms Script
application/javascript 136.243.52.8
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://clickdomain.ir/wp-content/themes/flozen-theme/assets/js/min/countdown.min.js
Requested by: Host: icloud-web.ir
URL: https://icloud-web.ir/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 136.243.52.8 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: nova3.euhosted.com
Software: LiteSpeed /
Resource Hash: 735ebc421a7bd8a74a43092e34b7da6ca54a32745ce3dc0f3efec8452fdaa1bb

Request headers

Referer: https://icloud-web.ir/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Dec 2020 20:57:40 GMT
content-encoding: br
last-modified: Wed, 09 Sep 2020 18:19:53 GMT
server: LiteSpeed
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: public, max-age=31536000,public
accept-ranges: bytes
content-length: 5061
expires: Sun, 26 Dec 2021 20:57:40 GMT

GET
H2 200 coming-soon.min.js Show response
clickdomain.ir/wp-content/themes/flozen-theme/assets/js/min/ 923 B
404 B 33ms
33ms Script
application/javascript 136.243.52.8
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://clickdomain.ir/wp-content/themes/flozen-theme/assets/js/min/coming-soon.min.js
Requested by: Host: icloud-web.ir
URL: https://icloud-web.ir/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 136.243.52.8 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: nova3.euhosted.com
Software: LiteSpeed /
Resource Hash: bcb7429b13d8c8e1f1366414bba13a4228cb3a013b0b94f7c8ef2a0b80d2b73c

Request headers

Referer: https://icloud-web.ir/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Dec 2020 20:57:40 GMT
content-encoding: br
last-modified: Wed, 09 Sep 2020 18:19:51 GMT
server: LiteSpeed
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: public, max-age=31536000,public
accept-ranges: bytes
content-length: 346
expires: Sun, 26 Dec 2021 20:57:40 GMT

Verdicts & Comments Add Verdict or Comment

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery object| nasa_countdown_l10n function| JQClass

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
clickdomain.ir
icloud-web.ir
136.243.52.8
2a00:1450:4001:81a::200a
4686b37aaeb9d1f68992a44ba58e2eec3cbb0abfd36ed2f08cfd9c7b5ecabb4f
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
735ebc421a7bd8a74a43092e34b7da6ca54a32745ce3dc0f3efec8452fdaa1bb
b8369e3565aa5f03588d51251e341fe4a5de1ec396d552d8fc374fdf317f40d3
bcb7429b13d8c8e1f1366414bba13a4228cb3a013b0b94f7c8ef2a0b80d2b73c
d3af0ecd9370da8f1d228c0c983a5de151a0339fa9a1f5e6f8364f6b69ab625d
f666cc34637b3dc4c487b69b2ed5fd5702c0fede8c3a7a651551531c2dc34046