ex-mailsrvice.com - urlscan.io

Summary

This website contacted 2 IPs in 3 countries across 4 domains to perform 2 HTTP transactions. The main IP is 116.12.50.104, located in Singapore, Singapore and belongs to USONYX-AS-AP USONYX PTE LTD, SG. The main domain is ex-mailsrvice.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on March 25th 2019. Valid for: 3 months.

This is the only time ex-mailsrvice.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	54.191.11.120 54.191.11.120	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 1	87.240.129.133 87.240.129.133	47541 (VKONTAKTE...) (VKONTAKTE-SPB-AS http://vk.com)
1	87.240.190.67 87.240.190.67	47541 (VKONTAKTE...) (VKONTAKTE-SPB-AS http://vk.com)
2 2	45.40.140.1 45.40.140.1	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com)
1	116.12.50.104 116.12.50.104	38532 (USONYX-AS...) (USONYX-AS-AP USONYX PTE LTD)
2	2

1 54.191.11.120 (Boardman, United States) 1 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-191-11-120.us-west-2.compute.amazonaws.com

d.pr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 87.240.129.133 (Russian Federation) 1 redirects

ASN47541 (VKONTAKTE-SPB-AS http://vk.com, RU)
PTR: srv133-129-240-87.vk.com

vk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 87.240.190.67 (Russian Federation)

ASN47541 (VKONTAKTE-SPB-AS http://vk.com, RU)
PTR: srv67-190-240-87.vk.com

away.vk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 45.40.140.1 (Scottsdale, United States) 2 redirects

ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-45-40-140-1.ip.secureserver.net

x.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 116.12.50.104 (Singapore, Singapore)

ASN38532 (USONYX-AS-AP USONYX PTE LTD, SG)
PTR: nathania.alrafaeis.com

ex-mailsrvice.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	x.co 2 redirects x.co	286 B
2	vk.com 1 redirects vk.com away.vk.com	1 KB
1	ex-mailsrvice.com ex-mailsrvice.com	700 B
1	d.pr 1 redirects d.pr	304 B
2	4

	Domain	Requested by
2	x.co	2 redirects
1	ex-mailsrvice.com	away.vk.com
1	away.vk.com
1	vk.com	1 redirects
1	d.pr	1 redirects
2	5

This site contains no links.

Subject Issuer	Validity	Valid
ex-mailsrvice.com Let's Encrypt Authority X3	`2019-03-25` - `2019-06-23`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://ex-mailsrvice.com/?ys
Frame ID: 36315A8A19E8B4B34E4ED376C7D97AD5
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://d.pr/xqb58p?cuek=BD33FBC0DE HTTP 302
https://vk.com/away.php?to=http%3A%2F%2Fx.co%2F6njen&post=537117858_5&cc_key= HTTP 302
http://away.vk.com/away.php Page URL
http://x.co/6njen HTTP 301
https://x.co/6njen HTTP 302
https://ex-mailsrvice.com/?ys Page URL

Page Statistics

2
Requests

50 %
HTTPS

0 %
IPv6

4
Domains

5
Subdomains

2
IPs

3
Countries

1 kB
Transfer

1 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://d.pr/xqb58p?cuek=BD33FBC0DE HTTP 302
https://vk.com/away.php?to=http%3A%2F%2Fx.co%2F6njen&post=537117858_5&cc_key= HTTP 302
http://away.vk.com/away.php Page URL
http://x.co/6njen HTTP 301
https://x.co/6njen HTTP 302
https://ex-mailsrvice.com/?ys Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://d.pr/xqb58p?cuek=BD33FBC0DE HTTP 302
https://vk.com/away.php?to=http%3A%2F%2Fx.co%2F6njen&post=537117858_5&cc_key= HTTP 302
http://away.vk.com/away.php

2 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Cookie set away.php Show response away.vk.com/ Redirect Chain https://d.pr/xqb58p?cuek=BD33FBC0DE https://vk.com/away.php?to=http%3A%2F%2Fx.co%2F6njen&post=537117858_5&cc_key= http://away.vk.com/away.php	338 B 786 B	111ms 52ms	Document text/html	87.240.190.67 VKONTAKTE-SPB-AS ...
General Check archive.org Show headers Download Go to Full URL http://away.vk.com/away.php Protocol HTTP/1.1 Server 87.240.190.67 , Russian Federation, ASN47541 (VKONTAKTE-SPB-AS http://vk.com, RU), Reverse DNS srv67-190-240-87.vk.com Software Internet Information Services / PHP/3.18651 Resource Hash `2dad15f45fc57f79a64d3ecf005794a02bea5fd8e8ccf5dcabd3ab52b64cc9f7` Request headers Host away.vk.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Accept-Encoding gzip, deflate Cookie remixlang=6; remixsec_redir=http%3A%2F%2Fx.co%2F6njen Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Server Internet Information Services Date Tue, 26 Mar 2019 19:49:10 GMT Content-Type text/html; charset=windows-1251 Content-Length 238 Connection keep-alive X-Powered-By PHP/3.18651 Cache-control no-store Set-Cookie remixsec_redir=DELETED; expires=Thu, 01 Jan 1970 00:00:01 GMT; path=/; domain=.vk.com remixsec_redir=DELETED; expires=Thu, 01 Jan 1970 00:00:01 GMT; path=/; domain=away.vk.com remixsec_redir=DELETED; expires=Thu, 01 Jan 1970 00:00:01 GMT; path=/ Content-Encoding gzip Redirect headers status 302 server nginx date Tue, 26 Mar 2019 19:49:10 GMT content-type text/html; charset=windows-1251 content-length 20 location http://away.vk.com/away.php x-powered-by PHP/3.18651 set-cookie remixlang=6; expires=Sat, 04 Apr 2020 22:00:23 GMT; path=/; domain=.vk.com remixsec_redir=http%3A%2F%2Fx.co%2F6njen; path=/; domain=.vk.com cache-control no-store content-encoding gzip strict-transport-security max-age=15768000 x-frontend front623304 access-control-expose-headers X-Frontend
GET H/1.1	404 Not Found	Primary Request Cookie set / Show response ex-mailsrvice.com/ Redirect Chain http://x.co/6njen https://x.co/6njen https://ex-mailsrvice.com/?ys	354 B 700 B	1974ms 1380ms	Document text/html	116.12.50.104 USONYX-AS-AP USON...
General Check archive.org Show headers Download Go to Full URL https://ex-mailsrvice.com/?ys Requested by Host: away.vk.com URL: http://away.vk.com/away.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 116.12.50.104 Singapore, Singapore, ASN38532 (USONYX-AS-AP USONYX PTE LTD, SG), Reverse DNS nathania.alrafaeis.com Software Apache / Resource Hash `dc7ff4fd2f074d28076d5c8c25c5d00d482b332da23d6b6cb903a1262252e854` Request headers Host ex-mailsrvice.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Referer http://away.vk.com/away.php Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer http://away.vk.com/away.php Response headers Date Tue, 26 Mar 2019 19:49:11 GMT Server Apache Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Content-Encoding gzip Vary Accept-Encoding Set-Cookie PHPSESSID=ik6a31ibmljmc0arba82338ti6; path=/ Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Redirect headers status 302 server nginx/1.12.2 date Tue, 26 Mar 2019 19:49:11 GMT content-type text/html; charset=utf-8 location https://ex-mailsrvice.com/?ys

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			ex-mailsrvice.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: ik6a31ibmljmc0arba82338ti6

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

away.vk.com
d.pr
ex-mailsrvice.com
vk.com
x.co
116.12.50.104
45.40.140.1
54.191.11.120
87.240.129.133
87.240.190.67
2dad15f45fc57f79a64d3ecf005794a02bea5fd8e8ccf5dcabd3ab52b64cc9f7
dc7ff4fd2f074d28076d5c8c25c5d00d482b332da23d6b6cb903a1262252e854

ex-mailsrvice.com Open in urlscan Pro 116.12.50.104 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

2 Requests

50 %HTTPS

0 %IPv6

4 Domains

5 Subdomains

2 IPs

3 Countries

1 kBTransfer

1 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

1 Cookies

Indicators

ex-mailsrvice.com Open in urlscan Pro
116.12.50.104 Public Scan

Screenshot
Live screenshot

Full Image

2
Requests

50 %
HTTPS

0 %
IPv6

4
Domains

5
Subdomains

2
IPs

3
Countries

1 kB
Transfer

1 kB
Size

1
Cookies

2 HTTP transactions
0 data transactions