urlscan.io logo urlscan.io
SecurityTrails logo

citib.ru Open in urlscan Pro
188.234.238.103  Public Scan

Go To Rescan Add Verdict Report
URL: https://citib.ru/
Submission: On May 25 via automatic, source certstream-suspicious — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 1 countries across 4 domains to perform 10 HTTP transactions. The main IP is 188.234.238.103, located in Yekaterinburg, Russian Federation and belongs to EKAT-AS, RU. The main domain is citib.ru.
TLS certificate: Issued by R3 on May 25th 2023. Valid for: 3 months.
This is the only time citib.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
4 188.234.238.103 51604 (EKAT-AS)
2 178.248.232.183 197068 (QRATOR)
2 213.79.65.56 8732 (COMCOR-AS...)
10 4
Apex Domain
Subdomains		 Transfer
4 citib.ru
citib.ru
178 KB
2 drweb.com
st.drweb.com
17 KB
2 drweb.ru
www.drweb.ru
21 KB
0 Failed
function sub() { [native code] }. Failed
10 4
Domain Requested by
4 citib.ru citib.ru
2 st.drweb.com www.drweb.ru
2 www.drweb.ru citib.ru
www.drweb.ru
0 zap Failed citib.ru
0 burp Failed citib.ru
10 5

This site contains links to these domains. Also see Links.

Domain
st.drweb.com
download.drweb.ru
products.drweb.ru
Subject Issuer Validity Valid
citib.ru
R3		 2023-05-25 -
2023-08-23		 3 months crt.sh
*.drweb.ru
GlobalSign GCC R3 DV TLS CA 2020		 2022-12-23 -
2024-01-24		 a year crt.sh
*.drweb.com
GlobalSign GCC R3 DV TLS CA 2020		 2022-12-28 -
2024-01-29		 a year crt.sh

This page contains 1 frames:

Primary Page: https://citib.ru/
Frame ID: D48D9DAC45D434A49DE59266806D22D1
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

ЦИТИБ - информационная безопасность

Page Statistics

10
Requests

80 %
HTTPS

0 %
IPv6

4
Domains

5
Subdomains

4
IPs

1
Countries

216 kB
Transfer

213 kB
Size

3
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
citib.ru/ 		1 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://citib.ru/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
188.234.238.103 Yekaterinburg, Russian Federation, ASN51604 (EKAT-AS, RU),
Reverse DNS
188x234x238x103.static-business.ekat.ertelecom.ru
Software
/
Resource Hash
5e5ce75abe16628747b931c97d0d32109a5bac05f1cc38aebaf0f7a171ca3401
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html
Date
Thu, 25 May 2023 07:19:50 GMT
Transfer-Encoding
chunked
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-XSS-Protection
1; mode=block
646eff4e33357e452cebcce9.js
citib.ru/ 		175 KB
175 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://citib.ru/646eff4e33357e452cebcce9.js?1677597103396
Requested by
Host: citib.ru
URL: https://citib.ru/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
188.234.238.103 Yekaterinburg, Russian Federation, ASN51604 (EKAT-AS, RU),
Reverse DNS
188x234x238x103.static-business.ekat.ertelecom.ru
Software
/
Resource Hash
3eb0decd091c8097390d9f786c48703fb1fb6ae897afaad137d8e60e82cec911

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citib.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Date
Thu, 25 May 2023 07:19:50 GMT
Last-Modified
Thu, 25 May 2023 06:27:15 GMT
ETag
"646effc3-2bb76"
Content-Type
application/x-javascript
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
179062
Expires
Thu, 01 Jun 2023 07:19:50 GMT
/
www.drweb.ru/export/mac/ 		18 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.drweb.ru/export/mac/?a=descriptions&m=DESCRIPT_WIN_WORK&l=ru&h=2
Requested by
Host: citib.ru
URL: https://citib.ru/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
178.248.232.183 , Russian Federation, ASN197068 (QRATOR, RU),
Reverse DNS
Software
QRATOR /
Resource Hash
d9d7c1a2e3d53e26c9dc83cb8a132b8d485d29a3c3bb4eea4648655c1795113c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citib.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Date
Thu, 25 May 2023 07:19:50 GMT
X-Content-Type-Options
nosniff
Referrer-Policy
no-referrer-when-downgrade
Server
QRATOR
X-Frame-Options
SAMEORIGIN
Transfer-Encoding
chunked
Content-Type
text/javascript; charset=utf-8
Connection
keep-alive
Keep-Alive
timeout=15
X-XSS-Protection
1; mode=block
/
www.drweb.ru/export/mac/ 		2 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.drweb.ru/export/mac/?a=makros&l=ru&m=WIN_WORK_LIC&h=12
Requested by
Host: www.drweb.ru
URL: https://www.drweb.ru/export/mac/?a=descriptions&m=DESCRIPT_WIN_WORK&l=ru&h=2
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
178.248.232.183 , Russian Federation, ASN197068 (QRATOR, RU),
Reverse DNS
Software
QRATOR /
Resource Hash
7b845033584db29b012dccb9046b6430b71c24afc7448867a2ab5471c15e2a36
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://citib.ru/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date
Thu, 25 May 2023 07:19:52 GMT
X-Content-Type-Options
nosniff
Referrer-Policy
no-referrer-when-downgrade
Server
QRATOR
X-Frame-Options
SAMEORIGIN
Transfer-Encoding
chunked
Content-Type
text/javascript; charset=utf-8
Connection
keep-alive
Keep-Alive
timeout=15
X-XSS-Protection
1; mode=block
ESS_box_for_descriptions_ru.png
st.drweb.com/static/new-www/box/ 		14 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://st.drweb.com/static/new-www/box/ESS_box_for_descriptions_ru.png?r=1
Requested by
Host: www.drweb.ru
URL: https://www.drweb.ru/export/mac/?a=descriptions&m=DESCRIPT_WIN_WORK&l=ru&h=2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.79.65.56 Moscow, Russian Federation, ASN8732 (COMCOR-AS Moscow, RU),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
cc40db9b4086406decc20705adf1169a365da530dfecb41ea41728c9e0b15c74

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citib.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Date
Thu, 25 May 2023 07:19:51 GMT
Last-Modified
Thu, 08 Oct 2020 09:28:33 GMT
Server
nginx/1.14.2
ETag
"5f7edbc1-3621"
Content-Type
image/png
Access-Control-Allow-Origin
*
Cache-Control
max-age=86400
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
13857
pdf_icon_ru.gif
st.drweb.com/static/new-www/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://st.drweb.com/static/new-www/pdf_icon_ru.gif
Requested by
Host: www.drweb.ru
URL: https://www.drweb.ru/export/mac/?a=descriptions&m=DESCRIPT_WIN_WORK&l=ru&h=2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.79.65.56 Moscow, Russian Federation, ASN8732 (COMCOR-AS Moscow, RU),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
2f2a6c813b83d95515218e49979c5aed8d09b257881ac2af2e461646c1161d62

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citib.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Date
Thu, 25 May 2023 07:19:51 GMT
Last-Modified
Thu, 08 May 2008 07:50:08 GMT
Server
nginx/1.14.2
ETag
"4822b0b0-aea"
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=86400
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2794
e19564320905dc32f5eccd65f996d76c.gif
citib.ru/ 		35 B
345 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://citib.ru/e19564320905dc32f5eccd65f996d76c.gif
Requested by
Host: citib.ru
URL: https://citib.ru/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
188.234.238.103 Yekaterinburg, Russian Federation, ASN51604 (EKAT-AS, RU),
Reverse DNS
188x234x238x103.static-business.ekat.ertelecom.ru
Software
/
Resource Hash
a518a350dd7714768892d4605561245113e1fd647c77e105226f92a88bf5a2d3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://citib.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 25 May 2023 07:19:52 GMT
Content-Type
image/gif
Cache-Control
no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
35
Expires
Tue, 03 Jul 2001 06:00:00 GMT
favicon.ico
burp/ 		0
0
favicon.ico
zap/ 		0
0
beee96cadd53ac1b60e690301887bb76
citib.ru/ 		0
506 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://citib.ru/beee96cadd53ac1b60e690301887bb76
Requested by
Host: citib.ru
URL: https://citib.ru/646eff4e33357e452cebcce9.js?1677597103396
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
188.234.238.103 Yekaterinburg, Russian Federation, ASN51604 (EKAT-AS, RU),
Reverse DNS
188x234x238x103.static-business.ekat.ertelecom.ru
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://citib.ru/
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
X-csrftoken
176251d610823cca5f2e8b100e06e243720f1b14cc72c02c42da22786a77614c4a009a96006b936f
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
Content-Type
application/octet-stream

Response headers

Date
Thu, 25 May 2023 07:19:53 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Transfer-Encoding
chunked
X-Frame-Options
SAMEORIGIN
Content-Type
text/html; charset=utf-8
Connection
keep-alive
X-XSS-Protection
1; mode=block

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
burp
URL
https://burp/favicon.ico
Domain
zap
URL
https://zap/favicon.ico

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| hmac object| acorn object| he function| DOMPurify function| DOMSanitizer

3 Cookies

Domain/Path Name / Value
citib.ru/ Name: session-cookie
Value: 176251d60df1998d8626c78abeb261f565cc5f01801c05e84ef1555ba3e8a5194b5cf07aa1d58eefb8b43a2f145b5c5a
citib.ru/ Name: csrf-token-name
Value: csrftoken
citib.ru/ Name: csrf-token-value
Value: 176251d6aa0791ad4883ee09920d44c81485c2cbdfb4489db11d752ec313dacb760835e94c40321b

4 Console Messages

Source Level URL
Text
javascript warning URL: https://www.drweb.ru/export/mac/?a=descriptions&m=DESCRIPT_WIN_WORK&l=ru&h=2
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://www.drweb.ru/export/mac/?a=makros&l=ru&m=WIN_WORK_LIC&h=12, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://www.drweb.ru/export/mac/?a=descriptions&m=DESCRIPT_WIN_WORK&l=ru&h=2
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://www.drweb.ru/export/mac/?a=makros&l=ru&m=WIN_WORK_LIC&h=12, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error URL: https://burp/favicon.ico
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network error URL: https://zap/favicon.ico
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block