domain.dot.tk Open in urlscan Pro
217.115.151.99 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://encapitalone.nimcard.ml/
Effective URL:
http://domain.dot.tk/p/?d=NIMCARD.ML&i=82.102.18.114&c=33&ro=0&ref=unknown&_=1592681715465
Submission: On June 20 via api (June 20th 2020, 7:35:30 pm UTC) from US

Summary HTTP 2 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 2 HTTP transactions. The main IP is 217.115.151.99, located in Germany and belongs to PLUSSERVER-ASN1, DE. The main domain is domain.dot.tk.

This is the only time domain.dot.tk was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
1	195.20.49.243 195.20.49.243		31624 (VFMNL-AS ...) (VFMNL-AS Amsterdam Location BGP Setup)
1	217.115.151.99 217.115.151.99		61157 (PLUSSERVE...) (PLUSSERVER-ASN1)
2	2

1 195.20.49.243 (Netherlands)

ASN31624 (VFMNL-AS Amsterdam Location BGP Setup, NL)

encapitalone.nimcard.ml	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 217.115.151.99 (Germany)

ASN61157 (PLUSSERVER-ASN1, DE)
PTR: n217-115-151-99.cnet.hosteurope.de

domain.dot.tk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	dot.tk domain.dot.tk	493 B
1	nimcard.ml encapitalone.nimcard.ml	976 B
2	2

	Domain	Requested by
1	domain.dot.tk	encapitalone.nimcard.ml
1	encapitalone.nimcard.ml
2	2

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://domain.dot.tk/p/?d=NIMCARD.ML&i=82.102.18.114&c=33&ro=0&ref=unknown&_=1592681715465
Frame ID: B1C351736E586B1D0FA292B7666B794C
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://encapitalone.nimcard.ml/ Page URL
http://domain.dot.tk/p/?d=NIMCARD.ML&i=82.102.18.114&c=33&ro=0&ref=unknown&_=1592681715465 Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

YouTube (Video Players) Expand

Overall confidence: 100%
Detected patterns

html /<(?:param|embed|iframe)[^>]+youtube(?:-nocookie)?\.com\/(?:v|embed)/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
script /([\d.]+)\/jquery-ui(?:\.min)?\.js/i
script /jquery-ui.*\.js/i

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /([\d.]+)\/jquery-ui(?:\.min)?\.js/i
script /jquery-ui.*\.js/i

Page Statistics

2
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

1 kB
Transfer

1 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://encapitalone.nimcard.ml/ Page URL
http://domain.dot.tk/p/?d=NIMCARD.ML&i=82.102.18.114&c=33&ro=0&ref=unknown&_=1592681715465 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	203	Cookie set / Show response encapitalone.nimcard.ml/	638 B 976 B	118ms 66ms	Document text/html	195.20.49.243 VFMNL-AS Amsterda...
General Check archive.org Show headers Download Go to Full URL http://encapitalone.nimcard.ml/ Protocol HTTP/1.1 Server 195.20.49.243 , Netherlands, ASN31624 (VFMNL-AS Amsterdam Location BGP Setup, NL), Reverse DNS Software nginx / Resource Hash `c905fbb7c24e2c523e27d530442a2ae4b4ee7e95a08a1fcf80ebfab25b6be59c` Request headers Host encapitalone.nimcard.ml Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Server nginx Date Sat, 20 Jun 2020 19:35:16 GMT Content-Type text/html;charset=UTF-8 Content-Length 638 Connection keep-alive Cache-Control no-cache Expires Thu, 01 Jan 1970 00:00:00 GMT Pragma no-cache Set-Cookie JSESSIONID=B847349F24365D07B53A15AE0CC6A7DD; Path=/; HttpOnly X-Server ip-172-30-1-167
GET H/1.0	503 Service Temporarily Unavailable	Primary Request / Show response domain.dot.tk/p/	323 B 493 B	10072ms 10052ms	Document text/html	217.115.151.99 PLUSSERVER-ASN1
General Check archive.org Show headers Download Go to Full URL http://domain.dot.tk/p/?d=NIMCARD.ML&i=82.102.18.114&c=33&ro=0&ref=unknown&_=1592681715465 Requested by Host: encapitalone.nimcard.ml URL: http://encapitalone.nimcard.ml/ Protocol HTTP/1.0 Server 217.115.151.99 , Germany, ASN61157 (PLUSSERVER-ASN1, DE), Reverse DNS n217-115-151-99.cnet.hosteurope.de Software / Resource Hash `446c53263851409a30dffc2ac5006dd1298be2856a74016d23f7c3169d66fc0a` Request headers Host domain.dot.tk Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer http://encapitalone.nimcard.ml/ Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer http://encapitalone.nimcard.ml/ Response headers Date Sat, 20 Jun 2020 19:35:15 GMT Content-Length 323 Connection close Content-Type text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

domain.dot.tk
encapitalone.nimcard.ml
195.20.49.243
217.115.151.99
446c53263851409a30dffc2ac5006dd1298be2856a74016d23f7c3169d66fc0a
c905fbb7c24e2c523e27d530442a2ae4b4ee7e95a08a1fcf80ebfab25b6be59c