auth-xtranet.shop Open in urlscan Pro
2a06:98c1:3121::3 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://blog.neoroots.design/wp-content/plugins/backup-backup/includes/r.php
Effective URL:
https://auth-xtranet.shop/sign-in
Submission: On March 04 via api (March 4th 2024, 8:34:30 pm UTC) from US — Scanned from DE

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 9 HTTP transactions. The main IP is 2a06:98c1:3121::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is auth-xtranet.shop.
TLS certificate: Issued by GTS CA 1P5 on March 3rd 2024. Valid for: 3 months.

This is the only time auth-xtranet.shop was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 2	209.151.149.182 209.151.149.182	25697 (UPCLOUDUSA) (UPCLOUDUSA)
1 1	5.8.52.77 5.8.52.77	34665 (PINDC-AS) (PINDC-AS)
1 4	2a06:98c1:312... 2a06:98c1:3121::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a04:4e42:400... 2a04:4e42:400::649	54113 (FASTLY) (FASTLY)
9	3

2 209.151.149.182 (United States) 2 redirects

ASN25697 (UPCLOUDUSA, US)
PTR: 209-151-149-182.us-nyc1.upcloud.host

blog.neoroots.design	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 5.8.52.77 (Russian Federation) 1 redirects

ASN34665 (PINDC-AS, RU)

5.8.52.77	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a06:98c1:3121::3 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

auth-xtranet.shop	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:400::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	auth-xtranet.shop 1 redirects auth-xtranet.shop	18 KB
2	neoroots.design 2 redirects blog.neoroots.design	477 B
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 760	30 KB
9	3

	Domain	Requested by
4	auth-xtranet.shop	1 redirects code.jquery.com auth-xtranet.shop
2	blog.neoroots.design	2 redirects
1	code.jquery.com	auth-xtranet.shop
9	3

This site contains no links.

Subject Issuer	Validity	Valid
auth-xtranet.shop GTS CA 1P5	`2024-03-03` - `2024-06-01`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://auth-xtranet.shop/sign-in
Frame ID: 925D1889BBB54C1EC29B28D916D1EAFC
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://blog.neoroots.design/wp-content/plugins/backup-backup/includes/r.php HTTP 301
https://blog.neoroots.design/wp-content/plugins/backup-backup/includes/r.php HTTP 302
http://5.8.52.77/Q6Ff6B HTTP 302
https://auth-xtranet.shop/ HTTP 302
https://auth-xtranet.shop/sign-in Page URL
https://auth-xtranet.shop/sign-in Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

44 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

47 kB
Transfer

172 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://blog.neoroots.design/wp-content/plugins/backup-backup/includes/r.php HTTP 301
https://blog.neoroots.design/wp-content/plugins/backup-backup/includes/r.php HTTP 302
http://5.8.52.77/Q6Ff6B HTTP 302
https://auth-xtranet.shop/ HTTP 302
https://auth-xtranet.shop/sign-in Page URL
https://auth-xtranet.shop/sign-in Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://blog.neoroots.design/wp-content/plugins/backup-backup/includes/r.php HTTP 301
https://blog.neoroots.design/wp-content/plugins/backup-backup/includes/r.php HTTP 302
http://5.8.52.77/Q6Ff6B HTTP 302
https://auth-xtranet.shop/ HTTP 302
https://auth-xtranet.shop/sign-in

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	sign-in Show response auth-xtranet.shop/ Redirect Chain http://blog.neoroots.design/wp-content/plugins/backup-backup/includes/r.php https://blog.neoroots.design/wp-content/plugins/backup-backup/includes/r.php http://5.8.52.77/Q6Ff6B https://auth-xtranet.shop/ https://auth-xtranet.shop/sign-in	11 KB 5 KB	158ms 157ms	Document text/html	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://auth-xtranet.shop/sign-in Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `7f09f14b01d79f9d2667debe2e7bedf7237388c686fa9dca768a3214efdb5d2d` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cache-control no-store, no-cache, must-revalidate no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 cf-cache-status DYNAMIC cf-ray 85f4a5a38f570487-FRA content-encoding br content-type text/html; charset=UTF-8 date Mon, 04 Mar 2024 20:34:26 GMT expires Thu, 19 Nov 1981 08:52:00 GMT last-modified Monday, 04-Mar-2024 20:34:26 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ta6Q9Fc0Av7q1hKDrxhuQodMJBjwW1Xm4lMZh58A9d43r2t9Nos349nvl5Qy0ik2wjbWQHxlZAymUXsjVxzsPQole6fUQC0xtUHB4sVP8B%2Fq6MmmZaKbyd9Ds1%2Ff9HGsxyRotIHkqTG0FBcolJDwxw%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare Redirect headers alt-svc h3=":443"; ma=86400 cache-control no-store, no-cache, must-revalidate no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 cf-cache-status DYNAMIC cf-ray 85f4a5a1ccba0487-FRA content-type text/html; charset=UTF-8 date Mon, 04 Mar 2024 20:34:26 GMT expires Thu, 19 Nov 1981 08:52:00 GMT last-modified Monday, 04-Mar-2024 20:34:26 GMT location /sign-in nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=16aQKaAmlqXx5U95a1QcciK%2FW1mJqJEAcCK5CZKVqH9xF15XrOtFKABAs8hKoTD%2BAFnpfL%2Bm6tDIjyQ4ntQ0PDHOKWOeIco23C2kzG%2BLGEMSAribrn7hRr8xIl6nxukhQ5dMCXlWAx%2FBI8%2BMmzVz3A%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare
GET H2	200	jquery-3.7.1.min.js Show response code.jquery.com/	85 KB 30 KB	83ms 30ms	Script application/javascript	2a04:4e42:400::649 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.7.1.min.js Requested by Host: auth-xtranet.shop URL: https://auth-xtranet.shop/sign-in Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::649 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash `fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a` Request headers accept-language de-DE,de;q=0.9 Referer https://auth-xtranet.shop/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36 Response headers date Mon, 04 Mar 2024 20:34:26 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 14385793 x-cache HIT, HIT content-length 30336 x-served-by cache-lga21978-LGA, cache-fra-eddf8230139-FRA last-modified Fri, 18 Oct 1991 12:00:00 GMT server nginx x-timer S1709584467.771883,VS0,VE0 etag W/"28feccc0-155ed" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=604800 accept-ranges bytes x-cache-hits 34, 157940
POST H3	200	api auth-xtranet.shop/	2 B 605 B	3633ms 3632ms	XHR text/html	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://auth-xtranet.shop/api Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.7.1.min.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Accept / Referer https://auth-xtranet.shop/sign-in X-Requested-With XMLHttpRequest accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers pragma no-cache date Mon, 04 Mar 2024 20:34:30 GMT content-encoding br cf-cache-status DYNAMIC last-modified Monday, 04-Mar-2024 20:34:30 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=i0b3hQx6wH%2Fefsr1AkBro40aK1D7qTa8lhv1iiX9oRJdzqetf5kB5zFpCBS2X0MZRLKH903cUH0xHnS%2BOOrOR8AqptU%2BYwW8qWsCduTGfVesm8aLdhmDtCJXmljf1UjoPmE2s7DpGc3FjSts%2F9%2FxTQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=UTF-8 cache-control no-store, no-cache, must-revalidate, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 cf-ray 85f4a5a59f499bca-FRA alt-svc h3=":443"; ma=86400 expires Thu, 19 Nov 1981 08:52:00 GMT
GET H3	200	Primary Request sign-in Show response auth-xtranet.shop/	76 KB 12 KB	128ms 128ms	Document text/html	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://auth-xtranet.shop/sign-in Requested by Host: auth-xtranet.shop URL: https://auth-xtranet.shop/sign-in Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `69c9f38840549332d54dce2083cac2833687166e3d73406bd10a1bdbcddd5e1e` Request headers Referer https://auth-xtranet.shop/sign-in Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cache-control no-store, no-cache, must-revalidate no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 cf-cache-status DYNAMIC cf-ray 85f4a5bc49809bca-FRA content-encoding br content-type text/html; charset=UTF-8 date Mon, 04 Mar 2024 20:34:30 GMT expires Thu, 19 Nov 1981 08:52:00 GMT last-modified Monday, 04-Mar-2024 20:34:30 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wZnOehLp%2FdF602eykC4iyRrTGWh4nLV0ZgcAbiBG8VjwRsKBWo4Vm7K0IRFavkWm5DGeXBuPzTuEKjoRA3wjKfkiYVmB%2BW9wdfnlwCsuf%2FnmV88UEGhHiitVrRtj11AVRi7KWVqDVjUroTV6k6yxvw%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare
GET		45_1975cbc2f7eaad75f590.css auth-xtranet.shop/static/	0 0

GET		938_afde72b9aaa8302ff017.css auth-xtranet.shop/static/	0 0

GET		826_0d1737e180931a217647.css auth-xtranet.shop/static/	0 0

GET		jquery-3.6.4.min.js auth-xtranet.shop/static/	0 0

GET		js.cookie.min.js auth-xtranet.shop/static/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: auth-xtranet.shop
URL: https://auth-xtranet.shop/static/45_1975cbc2f7eaad75f590.css

Domain: auth-xtranet.shop
URL: https://auth-xtranet.shop/static/938_afde72b9aaa8302ff017.css

Domain: auth-xtranet.shop
URL: https://auth-xtranet.shop/static/826_0d1737e180931a217647.css

Domain: auth-xtranet.shop
URL: https://auth-xtranet.shop/static/jquery-3.6.4.min.js

Domain: auth-xtranet.shop
URL: https://auth-xtranet.shop/static/js.cookie.min.js

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
5.8.52.77/	1970-01-20 19:37:42	Name: _subid Value: a1n56sbkk
5.8.52.77/	1970-01-21 04:29:04	Name: f56f8 Value: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjExXCI6MTcwOTU4NDQ2Nn0sXCJjYW1wYWlnbnNcIjp7XCIxXCI6MTcwOTU4NDQ2Nn0sXCJ0aW1lXCI6MTcwOTU4NDQ2Nn0ifQ.8uiBvE9ty9Giws-_orqCPwyuOGlMIYTbj8J9a-Subfs
auth-xtranet.shop/	1969-12-31 23:59:59	Name: PHPSESSID Value: 6icnu7vf0o2pcvdj7f42ng7u30

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

auth-xtranet.shop
blog.neoroots.design
code.jquery.com
auth-xtranet.shop
209.151.149.182
2a04:4e42:400::649
2a06:98c1:3121::3
5.8.52.77
69c9f38840549332d54dce2083cac2833687166e3d73406bd10a1bdbcddd5e1e
7f09f14b01d79f9d2667debe2e7bedf7237388c686fa9dca768a3214efdb5d2d
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a

auth-xtranet.shop Open in urlscan Pro 2a06:98c1:3121::3 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

44 %HTTPS

50 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

47 kBTransfer

172 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

3 Cookies

Indicators

auth-xtranet.shop Open in urlscan Pro
2a06:98c1:3121::3 Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

44 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

47 kB
Transfer

172 kB
Size

3
Cookies

9 HTTP transactions
0 data transactions