example.com - urlscan.io

Summary

This website contacted 3 IPs in 1 countries across 4 domains to perform 3 HTTP transactions. The main IP is 2606:2800:220:1:248:1893:25c8:1946, located in United States and belongs to EDGECAST, US. The main domain is example.com. The Cisco Umbrella rank of the primary domain is 8305.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on March 14th 2022. Valid for: a year.

This is the only time example.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	2620:1ec:40::45 2620:1ec:40::45	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	5.161.117.246 5.161.117.246	213230 (HETZNER-C...) (HETZNER-CLOUD2-AS)
1	192.0.78.26 192.0.78.26	2635 (AUTOMATTIC) (AUTOMATTIC)
1	2606:2800:220... 2606:2800:220:1:248:1893:25c8:1946	15133 (EDGECAST) (EDGECAST)
3	3

1 2620:1ec:40::45 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

vax-936590512878vwk.azurefd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 5.161.117.246 (United States) 1 redirects

ASN213230 (HETZNER-CLOUD2-AS, DE)
PTR: static.246.117.161.5.clients.your-server.de

kbx-54405744036vaop.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.0.78.26 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

href.li	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:2800:220:1:248:1893:25c8:1946 (United States)

ASN15133 (EDGECAST, US)

example.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	example.com example.com — Cisco Umbrella Rank: 8305	849 B
1	href.li href.li — Cisco Umbrella Rank: 69979	311 B
1	kbx-54405744036vaop.com 1 redirects kbx-54405744036vaop.com	238 B
1	azurefd.net vax-936590512878vwk.azurefd.net	6 KB
3	4

	Domain	Requested by
1	example.com	href.li
1	href.li
1	kbx-54405744036vaop.com	1 redirects
1	vax-936590512878vwk.azurefd.net
3	4

This site contains links to these domains. Also see Links.

Domain
www.iana.org

Subject Issuer	Validity	Valid
*.azurefd.net Microsoft Azure TLS Issuing CA 02	`2022-09-24` - `2023-09-19`	a year	crt.sh
tls.automattic.com R3	`2022-08-25` - `2022-11-23`	3 months	crt.sh
www.example.org DigiCert TLS RSA SHA256 2020 CA1	`2022-03-14` - `2023-03-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://example.com/
Frame ID: EDA57F912ACD2E5D16C1008DDB315A1A
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Example Domain

Page URL History Show full URLs

https://vax-936590512878vwk.azurefd.net/ Page URL
https://kbx-54405744036vaop.com/?hqjl HTTP 302
https://href.li/?https://example.com Page URL
https://example.com/ Page URL

Page Statistics

3
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

3
IPs

1
Countries

7 kB
Transfer

8 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.iana.org/domains/example
Title: More information...

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://vax-936590512878vwk.azurefd.net/ Page URL
https://kbx-54405744036vaop.com/?hqjl HTTP 302
https://href.li/?https://example.com Page URL
https://example.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

https://kbx-54405744036vaop.com/?hqjl HTTP 302
https://href.li/?https://example.com

3 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 / Show response
vax-936590512878vwk.azurefd.net/ 6 KB
6 KB 524ms
505ms Document
text/html 2620:1ec:40::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://vax-936590512878vwk.azurefd.net/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:40::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 98aa69c13beebd41cf82e4a7d80aea2682567c7e6353a7384134d8945412d6e3

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
content-length: 6095
content-type: text/html
date: Tue, 11 Oct 2022 06:55:47 GMT
etag: "6334c233-17cf"
last-modified: Wed, 28 Sep 2022 21:52:51 GMT
x-azure-ref: 0dBNFYwAAAACMNv3TUnFYSLItT3lNjdPpRlJBMjMxMDUwNDE3MDA5AGVmYjc4Y2ZiLTlkYzMtNDIwZC05YTMxLWU1NzViYjMzMjQ3Mg==
x-cache: CONFIG_NOCACHE

GET
H2

200

/
href.li/
Redirect Chain

https://kbx-54405744036vaop.com/?hqjl
https://href.li/?https://example.com

416 B
311 B

169ms
140ms

Document
text/html

192.0.78.26
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://href.li/?https://example.com

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.26 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://vax-936590512878vwk.azurefd.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: br
content-type: text/html; charset=utf-8
date: Tue, 11 Oct 2022 06:55:50 GMT
server: nginx
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-ac: 2.hhn _dfw BYPASS

Redirect headers

Connection: keep-alive
Date: Tue, 11 Oct 2022 06:55:50 GMT
Keep-Alive: timeout=5
Transfer-Encoding: chunked
location: https://href.li?https://example.com

GET
H2 200 Primary Request / Show response
example.com/ 1 KB
849 B 381ms
93ms Document
text/html 2606:2800:220:1:248:1893:25c8:1946
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://example.com/
Requested by: Host: href.li
URL: https://href.li/?https://example.com
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:220:1:248:1893:25c8:1946 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (bsa/EB16) /
Resource Hash: ea8fac7c65fb589b0d53560f5251f74f9e9b243478dcb6b3ea79b5e36449c8d9

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 413676
cache-control: max-age=604800
content-encoding: gzip
content-length: 648
content-type: text/html; charset=UTF-8
date: Tue, 11 Oct 2022 06:55:50 GMT
etag: "3147526947+gzip"
expires: Tue, 18 Oct 2022 06:55:50 GMT
last-modified: Thu, 17 Oct 2019 07:18:26 GMT
server: ECS (bsa/EB16)
vary: Accept-Encoding
x-cache: HIT

Verdicts & Comments Add Verdict or Comment

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			kbx-54405744036vaop.com/	1969-12-31 23:59:59	Name: qPdM Value: jfJMLYpqZlEd

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

example.com
href.li
kbx-54405744036vaop.com
vax-936590512878vwk.azurefd.net
192.0.78.26
2606:2800:220:1:248:1893:25c8:1946
2620:1ec:40::45
5.161.117.246
98aa69c13beebd41cf82e4a7d80aea2682567c7e6353a7384134d8945412d6e3
ea8fac7c65fb589b0d53560f5251f74f9e9b243478dcb6b3ea79b5e36449c8d9

example.com Open in urlscan Pro 2606:2800:220:1:248:1893:25c8:1946 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

3 Requests

100 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

3 IPs

1 Countries

7 kBTransfer

8 kBSize

1 Cookies

1 Outgoing links

Page URL History

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

9 JavaScript Global Variables

1 Cookies

Indicators

example.com Open in urlscan Pro
2606:2800:220:1:248:1893:25c8:1946 Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

3
IPs

1
Countries

7 kB
Transfer

8 kB
Size

1
Cookies

3 HTTP transactions
0 data transactions