castlhill.com Open in urlscan Pro
159.65.99.190 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://aemk1qsd.s3.eu-west-3.amazonaws.com/dsfdsfds.html#qs=r-aecefafddbfjighaffffdidakgdidbfafdjhfafdjhfababadhaddiaceaihgachdeacbdhkeacb
Effective URL:
http://castlhill.com/images/whoops.jpg
Submission: On August 11 via api (August 11th 2022, 5:09:32 pm UTC) from BE — Scanned from FR

Summary HTTP 2 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 2 HTTP transactions. The main IP is 159.65.99.190, located in Santa Clara, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is castlhill.com. The Cisco Umbrella rank of the primary domain is 765006.

This is the only time castlhill.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	52.95.154.86 52.95.154.86	16509 (AMAZON-02) (AMAZON-02)
1 1	74.208.207.200 74.208.207.200	8560 (IONOS-AS ...) (IONOS-AS This is the joint network for IONOS)
1 1	144.172.64.10 144.172.64.10	8100 (ASN-QUADR...) (ASN-QUADRANET-GLOBAL)
1	159.65.99.190 159.65.99.190	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
2	2

1 52.95.154.86 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: s3-r-w.eu-west-3.amazonaws.com

aemk1qsd.s3.eu-west-3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.208.207.200 (United States) 1 redirects

ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE)
PTR: good-to-echoed.evenserene.com

74.208.207.200	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 144.172.64.10 (United States) 1 redirects

ASN8100 (ASN-QUADRANET-GLOBAL, US)
PTR: tacloban.co

www.ponopshiny.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 159.65.99.190 (Santa Clara, United States)

ASN14061 (DIGITALOCEAN-ASN, US)

castlhill.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	castlhill.com castlhill.com — Cisco Umbrella Rank: 765006	41 KB
1	ponopshiny.com 1 redirects www.ponopshiny.com	318 B
1	amazonaws.com aemk1qsd.s3.eu-west-3.amazonaws.com	666 B
2	3

	Domain	Requested by
1	castlhill.com	aemk1qsd.s3.eu-west-3.amazonaws.com
1	www.ponopshiny.com	1 redirects
1	aemk1qsd.s3.eu-west-3.amazonaws.com
2	3

This site contains no links.

Subject Issuer	Validity	Valid
*.s3.eu-west-3.amazonaws.com Amazon	`2021-12-14` - `2022-12-13`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://castlhill.com/images/whoops.jpg
Frame ID: AE87E1D4409D512F38E161CDA1DCB969
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

whoops.jpg (450×230)

Page URL History Show full URLs

https://aemk1qsd.s3.eu-west-3.amazonaws.com/dsfdsfds.html Page URL
http://74.208.207.200//qs=r-aecefafddbfjighaffffdidakgdidbfafdjhfafdjhfababadhaddiaceaihgachdeacbd... HTTP 302
https://www.ponopshiny.com/vjMcsZmGJP5-a_NvmuO3DFOhQ7861cR8hAPtEU1B5U44WYHddlu6K_XzexQspO6d8YYBmzRbJio_... HTTP 302
http://castlhill.com/images/whoops.jpg Page URL

Page Statistics

2
Requests

50 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

42 kB
Transfer

41 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://aemk1qsd.s3.eu-west-3.amazonaws.com/dsfdsfds.html Page URL
http://74.208.207.200//qs=r-aecefafddbfjighaffffdidakgdidbfafdjhfafdjhfababadhaddiaceaihgachdeacbdhkeacb HTTP 302
https://www.ponopshiny.com/vjMcsZmGJP5-a_NvmuO3DFOhQ7861cR8hAPtEU1B5U44WYHddlu6K_XzexQspO6d8YYBmzRbJio_9dUks6rfXA~~/42864_9527204_13/3134_422048756_42864_0_0_4444272_26_1623_102693_9527204_10_765/26 HTTP 302
http://castlhill.com/images/whoops.jpg Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	dsfdsfds.html aemk1qsd.s3.eu-west-3.amazonaws.com/	310 B 666 B	97ms 28ms	Document text/html	52.95.154.86 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://aemk1qsd.s3.eu-west-3.amazonaws.com/dsfdsfds.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.95.154.86 Paris, France, ASN16509 (AMAZON-02, US), Reverse DNS s3-r-w.eu-west-3.amazonaws.com Software AmazonS3 / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 accept-language fr-FR,fr;q=0.9 Response headers Accept-Ranges bytes Content-Length 310 Content-Type text/html Date Thu, 11 Aug 2022 17:09:26 GMT ETag "a525d288632fd1efd97c7eaad7e1e95f" Last-Modified Thu, 11 Aug 2022 12:12:35 GMT Server AmazonS3 x-amz-id-2 leRlqBgnAte2zSmdAL1NbfMZPdr6jK2VE7EZJLnrhxA/OXn9YRLDGA/ttv0jUKXDgYHCvrwEukI= x-amz-request-id HRQYTHXP7MWRH1V5
GET H/1.1	200 OK	Primary Request whoops.jpg Show response castlhill.com/images/ Redirect Chain http://74.208.207.200//qs=r-aecefafddbfjighaffffdidakgdidbfafdjhfafdjhfababadhaddiaceaihgachdeacbdhkeacb https://www.ponopshiny.com/vjMcsZmGJP5-a_NvmuO3DFOhQ7861cR8hAPtEU1B5U44WYHddlu6K_XzexQspO6d8YYBmzRbJio_9dUks6rfXA~~/42864_9527204_13/3134_422048756_42864_0_0_4444272_26_1623_102693_9527204_10_765/26 http://castlhill.com/images/whoops.jpg	41 KB 41 KB	354ms 157ms	Document image/jpeg	159.65.99.190 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL http://castlhill.com/images/whoops.jpg Requested by Host: aemk1qsd.s3.eu-west-3.amazonaws.com URL: https://aemk1qsd.s3.eu-west-3.amazonaws.com/dsfdsfds.html Protocol HTTP/1.1 Server 159.65.99.190 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx/1.12.2 / Resource Hash `378508849997be414ca3966a65635fd15b1bc2dbf1c733634b5054739088945e` Request headers Referer https://aemk1qsd.s3.eu-west-3.amazonaws.com/dsfdsfds.html#qs=r-aecefafddbfjighaffffdidakgdidbfafdjhfafdjhfababadhaddiaceaihgachdeacbdhkeacb Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 accept-language fr-FR,fr;q=0.9 Response headers Accept-Ranges bytes Connection keep-alive Content-Length 41589 Content-Type image/jpeg Date Thu, 11 Aug 2022 17:09:28 GMT ETag "5b4f9a05-a275" Last-Modified Wed, 18 Jul 2018 19:50:29 GMT Server nginx/1.12.2 Redirect headers Content-Length 0 Content-Type text/html; charset=UTF-8 Date Thu, 11 Aug 2022 17:09:27 GMT Location http://castlhill.com/images/whoops.jpg Server Apache

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.ponopshiny.com/	1969-12-31 23:59:59	Name: uid8759 Value: 696413793-20220811130927-7936d2c5fc1fc7c23c41ed9207a5488d-

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aemk1qsd.s3.eu-west-3.amazonaws.com
castlhill.com
www.ponopshiny.com
144.172.64.10
159.65.99.190
52.95.154.86
74.208.207.200
378508849997be414ca3966a65635fd15b1bc2dbf1c733634b5054739088945e

castlhill.com Open in urlscan Pro 159.65.99.190 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

2 Requests

50 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

2 IPs

2 Countries

42 kBTransfer

41 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

1 Cookies

Indicators

castlhill.com Open in urlscan Pro
159.65.99.190 Public Scan

Screenshot
Live screenshot

Full Image

2
Requests

50 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

42 kB
Transfer

41 kB
Size

1
Cookies

2 HTTP transactions
0 data transactions