yun.ir Open in urlscan Pro
168.119.97.252  Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request dxael4 Show response yun.ir/	1 KB 1 KB	217ms 180ms	Document text/html	168.119.97.252 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://yun.ir/dxael4 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 168.119.97.252 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.252.97.119.168.clients.your-server.de Software nginx/1.18.0 / Resource Hash 2a2bf85826e46a28b05a40840ef0453ac2ca57186c466927fbd78e42666a232e Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control no-cache, private content-type text/html; charset=UTF-8 date Tue, 08 Nov 2022 14:50:34 GMT server nginx/1.18.0
GET H2	200	js Show response www.googletagmanager.com/gtag/	109 KB 43 KB	49ms 23ms	Script application/javascript	2a00:1450:4001:812::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=UA-115765032-1 Requested by Host: yun.ir URL: https://yun.ir/dxael4 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash d02a08364f9ebfbf8271a491ee23f1bbb5ccf2b5cde36a4ec6038d3caf3e2dba Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://yun.ir/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 14:50:35 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 43532 x-xss-protection 0 last-modified Tue, 08 Nov 2022 12:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Tue, 08 Nov 2022 14:50:35 GMT
GET H2	200	clientsafe.js Show response yun.ir/	448 KB 449 KB	9ms 9ms	Script application/javascript	168.119.97.252 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://yun.ir/clientsafe.js Requested by Host: yun.ir URL: https://yun.ir/dxael4 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 168.119.97.252 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.252.97.119.168.clients.your-server.de Software nginx/1.18.0 / Resource Hash 8004c70864d1fcaa2958e4bfc6af6f2d0f16899e2fa311e8a4be8dbd1dceefd0 Request headers accept-language de-DE,de;q=0.9 Referer https://yun.ir/dxael4 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 14:50:34 GMT last-modified Tue, 25 Oct 2022 12:48:55 GMT server nginx/1.18.0 accept-ranges bytes etag "6357db37-7011b" content-length 459035 content-type application/javascript
GET H2	200	iframe.html Show response hotmailbox.me/ Frame A0CE	5 KB 2 KB	221ms 186ms	Document text/html	2606:4700:10::6816:53a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://hotmailbox.me/iframe.html Requested by Host: yun.ir URL: https://yun.ir/dxael4 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6816:53a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash 4e8a7b8835d42ce6470146910df5b9f1e9785e8f129f84cde751f0d7692f34b1 Request headers Referer https://yun.ir/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cf-cache-status DYNAMIC cf-ray 766f1f30fe629b69-FRA content-encoding br content-type text/html date Tue, 08 Nov 2022 14:50:35 GMT last-modified Wed, 24 Aug 2022 22:46:27 GMT server cloudflare vary Accept-Encoding x-powered-by ASP.NET
GET H/1.1	200 OK	perfectcanvas Show response customfingerprints.buyproaccs.com/	10 KB 2 KB	457ms 170ms	Fetch	31.192.236.24 CHELYABINSK-SIGNA...
General Check archive.org Show headers Download Go to Full URL https://customfingerprints.buyproaccs.com/perfectcanvas?publickey=nazqdu32ykndkoan5zrsblw9sf1tbfi7z2lqa3xuyrpro2n38qyi8hhr68ldoujy Requested by Host: yun.ir URL: https://yun.ir/clientsafe.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 31.192.236.24 Madrid, Spain, ASN44493 (CHELYABINSK-SIGNAL-AS, RU), Reverse DNS hitherebtc1.pserver.ru Software nginx/1.18.0 (Ubuntu) / Express Resource Hash a7d6d825db18e1f371dc28acdf46958bc147e7c845a33a38e24b57f501e18cb2 Security Headers Name Value Strict-Transport-Security max-age=15724800; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://yun.ir/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Date Tue, 08 Nov 2022 14:50:35 GMT Content-Encoding gzip Strict-Transport-Security max-age=15724800; includeSubDomains Server nginx/1.18.0 (Ubuntu) X-Powered-By Express Transfer-Encoding chunked Access-Control-Allow-Methods GET, POST, PUT, DELETE, PATCH, OPTIONS Access-Control-Allow-Origin * Vary Accept-Encoding Connection keep-alive Access-Control-Allow-Headers X-Requested-With, Content-Type, Accept-Datetime, Upgrade-Insecure-Requests, Authorization, Cache-Control, If-Match, If-Modified-Since, If-None-Match, If-Range, If-Unmodified-Since, Max-Forwards, Range, Pragma, X-Requested-With, DNT, X-HTTP-Method-Override, X-Csrf-Token, X-Request-ID
GET H2	200	analytics.js Show response www.google-analytics.com/	49 KB 20 KB	31ms 7ms	Script text/javascript	2a00:1450:4001:82b::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-115765032-1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://yun.ir/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Tue, 08 Nov 2022 13:15:54 GMT last-modified Tue, 27 Sep 2022 22:01:05 GMT server Golfe2 age 5681 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 20039 expires Tue, 08 Nov 2022 15:15:54 GMT
POST H2	200	collect Show response www.google-analytics.com/j/	1 B 200 B	15ms 14ms	XHR text/plain	2a00:1450:4001:82b::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j98&a=1799541352&t=pageview&_s=1&dl=https%3A%2F%2Fyun.ir%2Fdxael4&ul=en-us&de=UTF-8&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAACAAI~&jid=1547733282&gjid=1508551901&cid=1906030613.1667919035&tid=UA-115765032-1&_gid=781857255.1667919035&_r=1&gtm=2oub20&z=1024303151 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://yun.ir/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Tue, 08 Nov 2022 14:50:35 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://yun.ir cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	loadArkose.js Show response hotmailbox.me/ Frame A0CE	301 B 306 B	34ms 34ms	Script application/javascript	2606:4700:10::6816:53a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://hotmailbox.me/loadArkose.js Requested by Host: hotmailbox.me URL: https://hotmailbox.me/iframe.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6816:53a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cbd558a5f2e44ae9d84bebb53428c66350a145de7e6a269ac480d2cf7441d354 Request headers accept-language de-DE,de;q=0.9 Referer https://hotmailbox.me/iframe.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 14:50:35 GMT content-encoding br cf-cache-status HIT last-modified Fri, 19 Aug 2022 21:04:37 GMT server cloudflare age 1344 etag W/"2f6d5c4afb4d81:0" vary Accept-Encoding content-type application/javascript cache-control max-age=14400 cf-ray 766f1f32499c9b69-FRA
GET H2	200	funcaptcha.js Show response hotmailbox.me/ Frame A0CE	232 KB 54 KB	37ms 37ms	Script application/javascript	2606:4700:10::6816:53a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://hotmailbox.me/funcaptcha.js Requested by Host: hotmailbox.me URL: https://hotmailbox.me/loadArkose.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6816:53a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash 5da38688c97a3cbb2d928383990700d48fbb12c33af2afa9252e57580982ca2b Request headers accept-language de-DE,de;q=0.9 Referer https://hotmailbox.me/iframe.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 14:50:35 GMT content-encoding br cf-cache-status HIT last-modified Thu, 25 Aug 2022 12:58:37 GMT server cloudflare age 1346 etag W/"80bcf96382b8d81:0" x-powered-by ASP.NET vary Accept-Encoding content-type application/javascript cache-control max-age=14400 cf-ray 766f1f327a239b69-FRA
GET H/1.1	200 OK	setcookies Show response fingerprints.buyproaccs.com/ Frame 57FC	60 B 662 B	375ms 137ms	Document text/html	31.192.236.24 CHELYABINSK-SIGNA...
General Check archive.org Show headers Download Go to Full URL https://fingerprints.buyproaccs.com/setcookies Requested by Host: yun.ir URL: https://yun.ir/clientsafe.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 31.192.236.24 Madrid, Spain, ASN44493 (CHELYABINSK-SIGNAL-AS, RU), Reverse DNS hitherebtc1.pserver.ru Software nginx/1.18.0 (Ubuntu) / Express Resource Hash b3ef8fb9c6e34c97443dbd6e549199301e2cd1e10ca41b024598c28f0ff82349 Request headers Referer https://yun.ir/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Access-Control-Allow-Headers X-Requested-With, Content-Type, Accept-Datetime, Upgrade-Insecure-Requests, Authorization, Cache-Control, If-Match, If-Modified-Since, If-None-Match, If-Range, If-Unmodified-Since, Max-Forwards, Range, Pragma, X-Requested-With, DNT, X-HTTP-Method-Override, X-Csrf-Token, X-Request-ID Access-Control-Allow-Methods GET, POST, PUT, DELETE, PATCH, OPTIONS Access-Control-Allow-Origin * Connection keep-alive Content-Length 60 Date Tue, 08 Nov 2022 14:50:35 GMT Server nginx/1.18.0 (Ubuntu) X-Powered-By Express
POST H2	200	dump Show response arkose113.hotmailbox.me/arkose/ Frame A0CE	59 B 134 B	368ms 367ms	XHR application/json	2606:4700:10::6816:43a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://arkose113.hotmailbox.me/arkose/dump Requested by Host: hotmailbox.me URL: https://hotmailbox.me/funcaptcha.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6816:43a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash 955b8108f998249b81f83f39d44f56ad4d44b326a51dc49e00c20526975e562a Request headers Referer https://hotmailbox.me/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Content-Type application/json Response headers pragma no-cache date Tue, 08 Nov 2022 14:50:36 GMT content-encoding br cf-cache-status DYNAMIC server cloudflare x-aspnet-version 4.0.30319 x-powered-by ASP.NET content-type application/json; charset=utf-8 access-control-allow-origin * cache-control no-cache cf-ray 766f1f38c9569bdc-FRA expires -1
OPTIONS H2	200	dump arkose113.hotmailbox.me/arkose/ Frame	0 0	257ms 146ms	Preflight	2606:4700:10::6816:43a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://arkose113.hotmailbox.me/arkose/dump Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6816:43a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://hotmailbox.me Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers access-control-allow-headers content-type access-control-allow-origin * cache-control no-cache cf-cache-status DYNAMIC cf-ray 766f1f37df019bdc-FRA content-length 0 date Tue, 08 Nov 2022 14:50:36 GMT expires -1 pragma no-cache server cloudflare x-aspnet-version 4.0.30319 x-powered-by ASP.NET

25 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| gtag object| dataLayer function| PerfectCanvasPrecomputed function| PerfectCanvas function| ProcessFingerprint function| ProcessFingerprintNoCache function| ProcessFingerprintInternal object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga object| gaplugins object| gaGlobal object| gaData

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			yun.ir/	1970-01-20 08:01:51	Name: verified Value: 1667919034
			.yun.ir/	1970-01-20 16:54:39	Name: _ga Value: GA1.2.1906030613.1667919035
			.yun.ir/	1970-01-20 07:20:05	Name: _gid Value: GA1.2.781857255.1667919035
			.yun.ir/	1970-01-20 07:18:39	Name: _gat_gtag_UA_115765032_1 Value: 1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

arkose113.hotmailbox.me
customfingerprints.buyproaccs.com
fingerprints.buyproaccs.com
hotmailbox.me
www.google-analytics.com
www.googletagmanager.com
yun.ir
168.119.97.252
2606:4700:10::6816:43a
2606:4700:10::6816:53a
2a00:1450:4001:812::2008
2a00:1450:4001:82b::200e
31.192.236.24
2a2bf85826e46a28b05a40840ef0453ac2ca57186c466927fbd78e42666a232e
4e8a7b8835d42ce6470146910df5b9f1e9785e8f129f84cde751f0d7692f34b1
5da38688c97a3cbb2d928383990700d48fbb12c33af2afa9252e57580982ca2b
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
8004c70864d1fcaa2958e4bfc6af6f2d0f16899e2fa311e8a4be8dbd1dceefd0
955b8108f998249b81f83f39d44f56ad4d44b326a51dc49e00c20526975e562a
a7d6d825db18e1f371dc28acdf46958bc147e7c845a33a38e24b57f501e18cb2
b3ef8fb9c6e34c97443dbd6e549199301e2cd1e10ca41b024598c28f0ff82349
b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719
cbd558a5f2e44ae9d84bebb53428c66350a145de7e6a269ac480d2cf7441d354
d02a08364f9ebfbf8271a491ee23f1bbb5ccf2b5cde36a4ec6038d3caf3e2dba