pub-28d4092586b448e79e92f3fb4f498df0.r2.dev

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 3 HTTP transactions. The main IP is 2606:4700::6812:223, located in United States and belongs to CLOUDFLARENET, US. The main domain is pub-28d4092586b448e79e92f3fb4f498df0.r2.dev.
TLS certificate: Issued by E1 on June 3rd 2024. Valid for: 3 months.

This is the only time pub-28d4092586b448e79e92f3fb4f498df0.r2.dev was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	67.223.118.155 67.223.118.155	22612 (NAMECHEAP...) (NAMECHEAP-NET)
1 1	2a00:1450:400... 2a00:1450:4001:810::2001	15169 (GOOGLE) (GOOGLE)
2	2606:4700::68... 2606:4700::6812:223	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	198.54.125.88 198.54.125.88	22612 (NAMECHEAP...) (NAMECHEAP-NET)
3	3

1 67.223.118.155 (United States) 1 redirects

ASN22612 (NAMECHEAP-NET, US)
PTR: server329-4.web-hosting.com

airdrop.gift	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2001 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

dappradx.page.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:223 (United States)

ASN13335 (CLOUDFLARENET, US)

pub-28d4092586b448e79e92f3fb4f498df0.r2.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 198.54.125.88 (United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: server216-6.web-hosting.com

vinovista.services	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	r2.dev pub-28d4092586b448e79e92f3fb4f498df0.r2.dev	54 KB
1	vinovista.services vinovista.services	148 B
1	page.link 1 redirects dappradx.page.link	1 KB
1	airdrop.gift 1 redirects airdrop.gift	136 B
3	4

	Domain	Requested by
2	pub-28d4092586b448e79e92f3fb4f498df0.r2.dev
1	vinovista.services	pub-28d4092586b448e79e92f3fb4f498df0.r2.dev
1	dappradx.page.link	1 redirects
1	airdrop.gift	1 redirects
3	4

This site contains no links.

Subject Issuer	Validity	Valid
*.r2.dev E1	`2024-06-03` - `2024-09-01`	3 months	crt.sh
vinovista.services Sectigo RSA Domain Validation Secure Server CA	`2023-11-28` - `2024-11-28`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://pub-28d4092586b448e79e92f3fb4f498df0.r2.dev/hub/airdrops/checker.html
Frame ID: 2B93C98C65917EAD0C8A8815C318E448
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Just a moment...

Page URL History Show full URLs

https://airdrop.gift/ HTTP 301
https://dappradx.page.link/R6GT HTTP 302
https://pub-28d4092586b448e79e92f3fb4f498df0.r2.dev/hub/airdrops/checker.html Page URL

Page Statistics

3
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

54 kB
Transfer

68 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://airdrop.gift/ HTTP 301
https://dappradx.page.link/R6GT HTTP 302
https://pub-28d4092586b448e79e92f3fb4f498df0.r2.dev/hub/airdrops/checker.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request checker.html Show response pub-28d4092586b448e79e92f3fb4f498df0.r2.dev/hub/airdrops/ Redirect Chain https://airdrop.gift/ https://dappradx.page.link/R6GT https://pub-28d4092586b448e79e92f3fb4f498df0.r2.dev/hub/airdrops/checker.html	27 KB 27 KB	601ms 481ms	Document text/html	2606:4700::6812:223 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pub-28d4092586b448e79e92f3fb4f498df0.r2.dev/hub/airdrops/checker.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `4f9d350aae73587a793ede3a0fe306f6b57ca698a6344298bfced6a1a61d8750` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers Accept-Ranges bytes CF-RAY 899be3977f4d8ec7-FRA Connection keep-alive Content-Length 27451 Content-Type text/html Date Wed, 26 Jun 2024 08:39:50 GMT ETag "710ddb622b01a51523d2a8a3a5c52e9a" Last-Modified Fri, 17 May 2024 08:36:32 GMT Server cloudflare Vary Accept-Encoding Redirect headers accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control no-cache, no-store, max-age=0, must-revalidate content-length 0 content-security-policy script-src 'report-sample' 'nonce-8GmZ6V9oAc-flbXWLNdv3Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DurableDeepLinkUi/cspreport;worker-src 'self' script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com https://www.googleapis.com/appsmarket/v2/installedApps/;report-uri /_/DurableDeepLinkUi/cspreport/allowlist require-trusted-types-for 'script';report-uri /_/DurableDeepLinkUi/cspreport content-type application/binary cross-origin-opener-policy unsafe-none cross-origin-resource-policy same-site date Wed, 26 Jun 2024 08:39:49 GMT expires Mon, 01 Jan 1990 00:00:00 GMT location https://pub-28d4092586b448e79e92f3fb4f498df0.r2.dev/hub/airdrops/checker.html permissions-policy ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* pragma no-cache server ESF vary Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site x-content-type-options nosniff x-frame-options SAMEORIGIN x-xss-protection 0
GET H2	200	ajax.php Show response vinovista.services/unajax/	0 148 B	1088ms 665ms	Script application/javascript	198.54.125.88 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://vinovista.services/unajax/ajax.php? Requested by Host: pub-28d4092586b448e79e92f3fb4f498df0.r2.dev URL: https://pub-28d4092586b448e79e92f3fb4f498df0.r2.dev/hub/airdrops/checker.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.125.88 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server216-6.web-hosting.com Software LiteSpeed / PHP/7.4.33 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://pub-28d4092586b448e79e92f3fb4f498df0.r2.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 26 Jun 2024 08:39:51 GMT server LiteSpeed x-powered-by PHP/7.4.33 content-type application/javascript access-control-allow-origin * cache-control no-store x-turbo-charged-by LiteSpeed content-length 0
GET DATA	200 OK	truncated Show response /	15 KB 0		Script text/javascript
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `987b7cf3e712246c1367220e11453139e10f50036bdec1116d13d07f7f663d59` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type text/javascript
GET H/1.1	404 Not Found	favicon.ico pub-28d4092586b448e79e92f3fb4f498df0.r2.dev/	27 KB 27 KB	348ms 348ms	Other text/html	2606:4700::6812:223 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pub-28d4092586b448e79e92f3fb4f498df0.r2.dev/favicon.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `570a6631252b8a52df4de0e953ae77dbdf524dfc3637cda2840494a0d2b49499` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://pub-28d4092586b448e79e92f3fb4f498df0.r2.dev/hub/airdrops/checker.html Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Wed, 26 Jun 2024 08:39:51 GMT Server cloudflare Connection keep-alive CF-RAY 899be3a17e3b8ec7-FRA Content-Length 27242 Vary Accept-Encoding Content-Type text/html

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://pub-28d4092586b448e79e92f3fb4f498df0.r2.dev/favicon.ico Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

airdrop.gift
dappradx.page.link
pub-28d4092586b448e79e92f3fb4f498df0.r2.dev
vinovista.services
198.54.125.88
2606:4700::6812:223
2a00:1450:4001:810::2001
67.223.118.155
4f9d350aae73587a793ede3a0fe306f6b57ca698a6344298bfced6a1a61d8750
570a6631252b8a52df4de0e953ae77dbdf524dfc3637cda2840494a0d2b49499
987b7cf3e712246c1367220e11453139e10f50036bdec1116d13d07f7f663d59
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

pub-28d4092586b448e79e92f3fb4f498df0.r2.dev Open in urlscan Pro 2606:4700::6812:223 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

3 Requests

100 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

3 IPs

2 Countries

54 kBTransfer

68 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

pub-28d4092586b448e79e92f3fb4f498df0.r2.dev Open in urlscan Pro
2606:4700::6812:223 Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

54 kB
Transfer

68 kB
Size

0
Cookies

3 HTTP transactions
1 data transactions