urlscan.io logo urlscan.io
SecurityTrails logo

test.flame-vpn.com Open in urlscan Pro
68.183.9.82  Public Scan

Go To Rescan Add Verdict Report
URL: https://test.flame-vpn.com/
Submission: On October 31 via automatic, source certstream-suspicious — Scanned from NL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 2 countries across 5 domains to perform 5 HTTP transactions. The main IP is 68.183.9.82, located in Amsterdam, Netherlands and belongs to DIGITALOCEAN-ASN, US. The main domain is test.flame-vpn.com.
TLS certificate: Issued by R3 on October 31st 2023. Valid for: 3 months.
This is the only time test.flame-vpn.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 68.183.9.82 14061 (DIGITALOC...)
1 81.19.89.17 24638 (RAMBLER-T...)
2 3 95.163.52.67 47764 (VK-AS)
1 87.242.127.163 208677 (CLOUDRU-AS)
5 5
Apex Domain
Subdomains		 Transfer
2 mail.ru
top-fwz1.mail.ru — Cisco Umbrella Rank: 10387
2 KB
2 rambler.ru
counter.rambler.ru — Cisco Umbrella Rank: 143672
top100-images.rambler.ru — Cisco Umbrella Rank: 743185
1 KB
1 list.ru
top.list.ru — Cisco Umbrella Rank: 483960
616 B
1 flame-vpn.com
test.flame-vpn.com
8 KB
0 spylog.com Failed
u083.69.spylog.com Failed
5 5
Domain Requested by
2 top-fwz1.mail.ru 1 redirects test.flame-vpn.com
1 top100-images.rambler.ru test.flame-vpn.com
1 top.list.ru 1 redirects
1 counter.rambler.ru test.flame-vpn.com
1 test.flame-vpn.com
0 u083.69.spylog.com Failed test.flame-vpn.com
5 6
Subject Issuer Validity Valid
test.flame-vpn.com
R3		 2023-10-31 -
2024-01-29		 3 months crt.sh
*.rambler.ru
GlobalSign GCC R3 DV TLS CA 2020		 2023-04-17 -
2024-05-18		 a year crt.sh
Kubernetes Ingress Controller Fake Certificate
Kubernetes Ingress Controller Fake Certificate		 2023-10-12 -
2024-10-11		 a year crt.sh

This page contains 1 frames:

Primary Page: https://test.flame-vpn.com/
Frame ID: 9F137933EB10293E27E9457CD54EF5EA
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Lib.Ru: Библиотека Максима Мошкова

Page Statistics

5
Requests

40 %
HTTPS

0 %
IPv6

5
Domains

6
Subdomains

5
IPs

2
Countries

10 kB
Transfer

21 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • https://top.list.ru/counter?id=105282;t=99 HTTP 302
  • https://top-fwz1.mail.ru/counter?id=105282;t=99;ver=20 HTTP 302
  • https://top-fwz1.mail.ru/counter2?id=105282;t=99;ver=20

5 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
test.flame-vpn.com/ 		21 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://test.flame-vpn.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
68.183.9.82 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.22.1 /
Resource Hash
92726a20fc4f6d46231fc1b4e24820504e0ff0483515a6ec292f9e66a98803c0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html; charset=windows-1251
Date
Tue, 31 Oct 2023 15:08:55 GMT
Last-Modified
Tue, 31 Oct 2023 06:12:22 GMT
Server
nginx/1.22.1
Transfer-Encoding
chunked
top100.cnt
counter.rambler.ru/ 		595 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://counter.rambler.ru/top100.cnt?59291
Requested by
Host: test.flame-vpn.com
URL: https://test.flame-vpn.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
81.19.89.17 , Russian Federation, ASN24638 (RAMBLER-TELECOM-AS, RU),
Reverse DNS
kraken.rambler.ru
Software
nginx /
Resource Hash
9955e76a0aa0414abf703f10e87d93722c71f3fa57c82eb7531c9473d9ef72fc

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://test.flame-vpn.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date
Tue, 31 Oct 2023 15:08:55 GMT
last-modified
Tue, 12 Nov 2019 12:50:59 GMT
server
nginx
x-srv
1kraken-prod0002.ad.rambler.tech
etag
"5dcaaab3-253"
access-control-allow-methods
GET, POST, OPTIONS
content-type
image/gif
p3p
CP="NON DSP NID ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
content-type
content-length
595
counter2
top-fwz1.mail.ru/
Redirect Chain
  • https://top.list.ru/counter?id=105282;t=99
  • https://top-fwz1.mail.ru/counter?id=105282;t=99;ver=20
  • https://top-fwz1.mail.ru/counter2?id=105282;t=99;ver=20
325 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://top-fwz1.mail.ru/counter2?id=105282;t=99;ver=20
Requested by
Host: test.flame-vpn.com
URL: https://test.flame-vpn.com/
Protocol
H2
Server
95.163.52.67 , Russian Federation, ASN47764 (VK-AS, RU),
Reverse DNS
top-fwz1.mail.ru
Software
nginx /
Resource Hash
8699c481de5504cbd29fbb347a5167da5446684f5ad3def61318fd74620136f7
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://test.flame-vpn.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date
Tue, 31 Oct 2023 15:08:56 GMT
x-content-type-options
nosniff
p3p
CP="NOI DSP COR NID CUR PSA OUR NOR"
content-length
325
pragma
no-cache
amp-access-control-allow-source-origin
*
server
nginx
accept-ch
DPR, Width, Viewport-Width, Downlink, Device-Memory, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version
access-control-allow-methods
GET, POST, HEAD, PUT, OPTIONS
content-type
image/gif
access-control-allow-origin
*
accept-ch-lifetime
86400
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
private, no-cache, no-store, max-age=0
access-control-allow-credentials
true
timing-allow-origin
*
access-control-allow-headers
*

Redirect headers

date
Tue, 31 Oct 2023 15:08:56 GMT
x-content-type-options
nosniff
p3p
CP="NOI DSP COR NID CUR PSA OUR NOR"
content-length
0
pragma
no-cache
amp-access-control-allow-source-origin
*
server
nginx
accept-ch
DPR, Width, Viewport-Width, Downlink, Device-Memory, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version
access-control-allow-methods
GET, POST, HEAD, PUT, OPTIONS
accept-ch-lifetime
86400
location
https://top-fwz1.mail.ru/counter2?id=105282;t=99;ver=20
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
private, no-cache, no-store, max-age=0
access-control-allow-credentials
true
timing-allow-origin
*
access-control-allow-headers
*
b0.gif
top100-images.rambler.ru/top100/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://top100-images.rambler.ru/top100/b0.gif
Requested by
Host: test.flame-vpn.com
URL: https://test.flame-vpn.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
87.242.127.163 , Russian Federation, ASN208677 (CLOUDRU-AS, RU),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://test.flame-vpn.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers
cnt
u083.69.spylog.com/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
u083.69.spylog.com
URL
https://u083.69.spylog.com/cnt?p=0

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture

2 Cookies

Domain/Path Name / Value
.rambler.ru/ Name: ruid
Value: 1CIAAIcYQWWJkZKNARDQJwB=
.mail.ru/ Name: VID
Value: 1SwuQK0XCQIL00000-1yT4oL:::0-0-0-a5b7148-0:CAASEHw3KHIOFDdpX6zuwtTCJAsaYMc9tK5_PRkJyBemD2Rt9Rb0c2fHwtNW06W0esoK9_4sqsiph1jrH-FBhH2FTjqNoE7kAlDu55I8DyKswtHx9Tlna94q-tVGcYne05ye86O4FkYuoylCzBMVyDtWUuSMqA

10 Console Messages

Source Level URL
Text
security warning URL: https://test.flame-vpn.com/
Message:
Mixed Content: The page at 'https://test.flame-vpn.com/' was loaded over HTTPS, but requested an insecure element 'http://counter.rambler.ru/top100.cnt?59291'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security warning URL: https://test.flame-vpn.com/
Message:
Mixed Content: The page at 'https://test.flame-vpn.com/' was loaded over HTTPS, but requested an insecure element 'http://top.list.ru/counter?id=105282;t=99'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security warning URL: https://test.flame-vpn.com/
Message:
Mixed Content: The page at 'https://test.flame-vpn.com/' was loaded over HTTPS, but requested an insecure element 'http://top100-images.rambler.ru/top100/b0.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security warning URL: https://test.flame-vpn.com/
Message:
Mixed Content: The page at 'https://test.flame-vpn.com/' was loaded over HTTPS, but requested an insecure element 'http://u083.69.spylog.com/cnt?p=0'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security warning URL: https://test.flame-vpn.com/(Line 259)
Message:
Mixed Content: The page at 'https://test.flame-vpn.com/' was loaded over HTTPS, but requested an insecure element 'http://counter.rambler.ru/top100.cnt?59291'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security warning URL: https://test.flame-vpn.com/(Line 259)
Message:
Mixed Content: The page at 'https://test.flame-vpn.com/' was loaded over HTTPS, but requested an insecure element 'http://top.list.ru/counter?id=105282;t=99'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security warning URL: https://test.flame-vpn.com/(Line 259)
Message:
Mixed Content: The page at 'https://test.flame-vpn.com/' was loaded over HTTPS, but requested an insecure element 'http://top100-images.rambler.ru/top100/b0.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security warning URL: https://test.flame-vpn.com/(Line 259)
Message:
Mixed Content: The page at 'https://test.flame-vpn.com/' was loaded over HTTPS, but requested an insecure element 'http://u083.69.spylog.com/cnt?p=0'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
network error URL: https://u083.69.spylog.com/cnt?p=0
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network error URL: https://top100-images.rambler.ru/top100/b0.gif
Message:
Failed to load resource: the server responded with a status of 404 ()