covid.dvinaland.ru Open in urlscan Pro
188.130.238.50 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://covid.dvinaland.ru/
Effective URL:
https://covid.dvinaland.ru/
Submission Tags: phishing malicious Search All
Submission: On May 01 via api (May 1st 2020, 4:11:32 pm UTC) from US

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 188.130.238.50, located in Moscow, Russian Federation and belongs to ARKHANGELSK-AS, CZ. The main domain is covid.dvinaland.ru.
TLS certificate: Issued by Let's Encrypt Authority X3 on April 28th 2020. Valid for: 3 months.

This is the only time covid.dvinaland.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
1 9	188.130.238.50 188.130.238.50		61416 (ARKHANGEL...) (ARKHANGELSK-AS)
8	1

9 188.130.238.50 (Moscow, Russian Federation) 1 redirects

ASN61416 (ARKHANGELSK-AS, CZ)
PTR: covid.dvinaland.ru

covid.dvinaland.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	dvinaland.ru 1 redirects covid.dvinaland.ru	320 KB
8	1

	Domain	Requested by
9	covid.dvinaland.ru	1 redirects covid.dvinaland.ru
8	1

This site contains no links.

Subject Issuer	Validity	Valid
covid.dvinaland.ru Let's Encrypt Authority X3	`2020-04-28` - `2020-07-27`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://covid.dvinaland.ru/
Frame ID: 30A4561536AD8AA877547CCAE91D1A3E
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://covid.dvinaland.ru/ HTTP 301
https://covid.dvinaland.ru/ Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

319 kB
Transfer

1379 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://covid.dvinaland.ru/ HTTP 301
https://covid.dvinaland.ru/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response covid.dvinaland.ru/ Redirect Chain http://covid.dvinaland.ru/ https://covid.dvinaland.ru/	2 KB 915 B	514ms 177ms	Document text/html	188.130.238.50 ARKHANGELSK-AS
General Check archive.org Show headers Download Go to Full URL https://covid.dvinaland.ru/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 188.130.238.50 Moscow, Russian Federation, ASN61416 (ARKHANGELSK-AS, CZ), Reverse DNS covid.dvinaland.ru Software nginx/1.18.0 / Resource Hash `02c38a513bd5b879a0385c1f58c54e6d00d46f941a4eb8b2c655926f4ee4c026` Request headers Host covid.dvinaland.ru Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Server nginx/1.18.0 Date Fri, 01 May 2020 16:11:05 GMT Content-Type text/html; charset=utf-8 Content-Length 528 Connection keep-alive Last-Modified Wed, 29 Apr 2020 08:50:16 GMT ETag "5ea93fc8-210" Content-Encoding br Expires Fri, 01 May 2020 16:11:05 GMT Cache-Control max-age=0 no-cache, public, must-revalidate, proxy-revalidate Redirect headers Server nginx/1.18.0 Date Fri, 01 May 2020 16:11:05 GMT Content-Type text/html Content-Length 169 Connection keep-alive Location https://covid.dvinaland.ru/
GET H/1.1	200 OK	app.3ec180da.css covid.dvinaland.ru/css/	192 KB 27 KB	374ms 373ms	Stylesheet text/css	188.130.238.50 ARKHANGELSK-AS
General Check archive.org Show headers Download Go to Full URL https://covid.dvinaland.ru/css/app.3ec180da.css Requested by Host: covid.dvinaland.ru URL: https://covid.dvinaland.ru/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 188.130.238.50 Moscow, Russian Federation, ASN61416 (ARKHANGELSK-AS, CZ), Reverse DNS covid.dvinaland.ru Software nginx/1.18.0 / Resource Hash `bb01b0c7d0713e069af4d62da918f76883ec9b15b64e09a9ef3dc2dff0025b76` Request headers Referer https://covid.dvinaland.ru/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 01 May 2020 16:11:06 GMT Content-Encoding br Last-Modified Wed, 29 Apr 2020 08:50:16 GMT Server nginx/1.18.0 ETag "5ea93fc8-68ca" Content-Type text/css Expires Thu, 31 Dec 2037 23:55:55 GMT Cache-Control max-age=315360000, public Connection keep-alive Content-Length 26826 X-Proxy-Cache MISS
GET H/1.1	200 OK	app.28a852ff.js Show response covid.dvinaland.ru/js/	70 KB 16 KB	694ms 319ms	Script application/javascript	188.130.238.50 ARKHANGELSK-AS
General Check archive.org Show headers Download Go to Full URL https://covid.dvinaland.ru/js/app.28a852ff.js Requested by Host: covid.dvinaland.ru URL: https://covid.dvinaland.ru/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 188.130.238.50 Moscow, Russian Federation, ASN61416 (ARKHANGELSK-AS, CZ), Reverse DNS covid.dvinaland.ru Software nginx/1.18.0 / Resource Hash `39596cfe68344bc272d83184b34fef67d21d0264ef28247d19865983b12116e3` Request headers Referer https://covid.dvinaland.ru/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 01 May 2020 16:11:06 GMT Content-Encoding br Last-Modified Wed, 29 Apr 2020 08:50:16 GMT Server nginx/1.18.0 ETag "5ea93fc8-3e3b" Content-Type application/javascript; charset=utf-8 Expires Thu, 31 Dec 2037 23:55:55 GMT Cache-Control max-age=315360000, public Connection keep-alive Content-Length 15931 X-Proxy-Cache MISS
GET H/1.1	200 OK	vendor.e4e82126.js Show response covid.dvinaland.ru/js/	1 MB 233 KB	695ms 321ms	Script application/javascript	188.130.238.50 ARKHANGELSK-AS
General Check archive.org Show headers Download Go to Full URL https://covid.dvinaland.ru/js/vendor.e4e82126.js Requested by Host: covid.dvinaland.ru URL: https://covid.dvinaland.ru/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 188.130.238.50 Moscow, Russian Federation, ASN61416 (ARKHANGELSK-AS, CZ), Reverse DNS covid.dvinaland.ru Software nginx/1.18.0 / Resource Hash `627a86b5baf50bbbd6588db834ae014d249cf9e3463cd0c0e770268d147229af` Request headers Referer https://covid.dvinaland.ru/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 01 May 2020 16:11:06 GMT Content-Encoding br Last-Modified Wed, 29 Apr 2020 08:50:16 GMT Server nginx/1.18.0 ETag "5ea93fc8-3a456" Content-Type application/javascript; charset=utf-8 Expires Thu, 31 Dec 2037 23:55:55 GMT Cache-Control max-age=315360000, public Connection keep-alive Content-Length 238678 X-Proxy-Cache MISS
GET H/1.1	200 OK	2.0f352cf7.js covid.dvinaland.ru/js/	0 703 B	550ms 176ms	Other application/javascript	188.130.238.50 ARKHANGELSK-AS
General Check archive.org Show headers Download Go to Full URL https://covid.dvinaland.ru/js/2.0f352cf7.js Requested by Host: covid.dvinaland.ru URL: https://covid.dvinaland.ru/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 188.130.238.50 Moscow, Russian Federation, ASN61416 (ARKHANGELSK-AS, CZ), Reverse DNS covid.dvinaland.ru Software nginx/1.18.0 / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://covid.dvinaland.ru/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 01 May 2020 16:11:06 GMT Content-Encoding br Last-Modified Wed, 29 Apr 2020 08:50:16 GMT Server nginx/1.18.0 ETag "5ea93fc8-13f" Content-Type application/javascript; charset=utf-8 Expires Thu, 31 Dec 2037 23:55:55 GMT Cache-Control max-age=315360000, public Connection keep-alive Content-Length 319 X-Proxy-Cache MISS
GET H/1.1	200 OK	KFOmCnqEu92Fr1Mu4mxM.60fa3c06.woff covid.dvinaland.ru/fonts/	20 KB 20 KB	183ms 182ms	Font font/woff	188.130.238.50 ARKHANGELSK-AS
General Check archive.org Show headers Download Go to Full URL https://covid.dvinaland.ru/fonts/KFOmCnqEu92Fr1Mu4mxM.60fa3c06.woff Requested by Host: covid.dvinaland.ru URL: https://covid.dvinaland.ru/js/vendor.e4e82126.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 188.130.238.50 Moscow, Russian Federation, ASN61416 (ARKHANGELSK-AS, CZ), Reverse DNS covid.dvinaland.ru Software nginx/1.18.0 / Resource Hash `c1dc87f99c7ff228806117d58f085c6c573057fa237228081802b7d8d3cf7684` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://covid.dvinaland.ru/css/app.3ec180da.css Origin https://covid.dvinaland.ru Response headers Date Fri, 01 May 2020 16:11:07 GMT Content-Encoding br Last-Modified Wed, 29 Apr 2020 08:50:16 GMT Server nginx/1.18.0 ETag "5ea93fc8-4eb5" Content-Type font/woff Expires Thu, 31 Dec 2037 23:55:55 GMT Cache-Control max-age=315360000, public Connection keep-alive Content-Length 20149 X-Proxy-Cache MISS
GET H/1.1	200 OK	KFOlCnqEu92Fr1MmEU9fBBc-.87284894.woff covid.dvinaland.ru/fonts/	20 KB 20 KB	326ms 326ms	Font font/woff	188.130.238.50 ARKHANGELSK-AS
General Check archive.org Show headers Download Go to Full URL https://covid.dvinaland.ru/fonts/KFOlCnqEu92Fr1MmEU9fBBc-.87284894.woff Requested by Host: covid.dvinaland.ru URL: https://covid.dvinaland.ru/js/vendor.e4e82126.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 188.130.238.50 Moscow, Russian Federation, ASN61416 (ARKHANGELSK-AS, CZ), Reverse DNS covid.dvinaland.ru Software nginx/1.18.0 / Resource Hash `ba98f991d002c6bfaaf7b874652ffdcde9261a86925db87df3ed2861ea080adf` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://covid.dvinaland.ru/css/app.3ec180da.css Origin https://covid.dvinaland.ru Response headers Date Fri, 01 May 2020 16:11:07 GMT Content-Encoding br Last-Modified Wed, 29 Apr 2020 08:50:16 GMT Server nginx/1.18.0 ETag "5ea93fc8-4f7e" Content-Type font/woff Expires Thu, 31 Dec 2037 23:55:55 GMT Cache-Control max-age=315360000, public Connection keep-alive Content-Length 20350 X-Proxy-Cache MISS
GET H/1.1	200 OK	cfg Show response covid.dvinaland.ru/api/	5 KB 2 KB	188ms 186ms	XHR application/json	188.130.238.50 ARKHANGELSK-AS
General Check archive.org Show headers Download Go to Full URL https://covid.dvinaland.ru/api/cfg Requested by Host: covid.dvinaland.ru URL: https://covid.dvinaland.ru/js/vendor.e4e82126.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 188.130.238.50 Moscow, Russian Federation, ASN61416 (ARKHANGELSK-AS, CZ), Reverse DNS covid.dvinaland.ru Software nginx/1.18.0 / Resource Hash `833c8cfb45a16f05d69079ac9c25d296e18a1e8eb238ccfac12a571f945018b0` Request headers Accept application/json, text/plain, / Referer https://covid.dvinaland.ru/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 01 May 2020 16:11:07 GMT content-encoding gzip Server nginx/1.18.0 Connection keep-alive Content-Length 1417 Content-Type application/json

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	error	URL: https://covid.dvinaland.ru/js/vendor.e4e82126.js(Line 14) Message: TypeError: Cannot read property 'getItem' of null
console-api	log	URL: https://covid.dvinaland.ru/js/app.28a852ff.js(Line 1) Message: CONSTANTS: [object Object]
console-api	log	URL: https://covid.dvinaland.ru/js/app.28a852ff.js(Line 1) Message: [object Object],[object Object],[object Object]

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

covid.dvinaland.ru
188.130.238.50
02c38a513bd5b879a0385c1f58c54e6d00d46f941a4eb8b2c655926f4ee4c026
39596cfe68344bc272d83184b34fef67d21d0264ef28247d19865983b12116e3
627a86b5baf50bbbd6588db834ae014d249cf9e3463cd0c0e770268d147229af
833c8cfb45a16f05d69079ac9c25d296e18a1e8eb238ccfac12a571f945018b0
ba98f991d002c6bfaaf7b874652ffdcde9261a86925db87df3ed2861ea080adf
bb01b0c7d0713e069af4d62da918f76883ec9b15b64e09a9ef3dc2dff0025b76
c1dc87f99c7ff228806117d58f085c6c573057fa237228081802b7d8d3cf7684
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

covid.dvinaland.ru Open in urlscan Pro 188.130.238.50 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

8 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

319 kBTransfer

1379 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

0 Cookies

3 Console Messages

Indicators

covid.dvinaland.ru Open in urlscan Pro
188.130.238.50 Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

319 kB
Transfer

1379 kB
Size

0
Cookies

8 HTTP transactions
0 data transactions