Submitted URL: http://r041.donnael.com/?S=5&E=2002502&DE=2021-01-27
Effective URL: https://r035.donnael.com/?&S=5&E=2002502&DE=2021-01-27&R=d41d44
Submission Tags: falconsandbox
Submission: On January 02 via api from US — Scanned from DE

Summary

This website contacted 2 IPs in 2 countries across 4 domains to perform 2 HTTP transactions. The main IP is 194.247.12.182, located in Ukraine and belongs to UKRAINE-AS, UA. The main domain is r035.donnael.com.
TLS certificate: Issued by R3 on November 26th 2021. Valid for: 3 months.
This is the only time r035.donnael.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 3 194.247.12.182 200000 (UKRAINE-AS)
1 1 178.253.25.34 202492 (SGHL1-AS)
1 1 178.253.25.121 202492 (SGHL1-AS)
2 3 178.253.36.20 202492 (SGHL1-AS)
2 2
Apex Domain
Subdomains
Transfer
3 lite-1x0798860.top
lite-1x0798860.top
639 B
3 donnael.com
r041.donnael.com
r044.donnael.com
r035.donnael.com
782 B
1 1-xredbet87963.top
1-xredbet87963.top
552 B
1 refpa832816.top
refpa832816.top
179 B
2 4
Domain Requested by
3 lite-1x0798860.top 2 redirects
1 1-xredbet87963.top 1 redirects
1 refpa832816.top 1 redirects
1 r035.donnael.com
1 r044.donnael.com 1 redirects
1 r041.donnael.com 1 redirects
2 6

This site contains no links.

Subject Issuer Validity Valid
r001.donnael.com
R3
2021-11-26 -
2022-02-24
3 months crt.sh
lite-1x0798860.top
R3
2021-12-24 -
2022-03-24
3 months crt.sh

This page contains 1 frames:

Frame: https://lite-1x0798860.top/de/blockPage
Frame ID: 3CA1D414E500C2B73050647B17618085
Requests: 2 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://r041.donnael.com/?S=5&E=2002502&DE=2021-01-27 HTTP 302
    https://r044.donnael.com/?&S=5&E=2002502&DE=2021-01-27&R=d41 HTTP 302
    https://r035.donnael.com/?&S=5&E=2002502&DE=2021-01-27&R=d41d44 Page URL

Page Statistics

2
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

6
Subdomains

2
IPs

2
Countries

0 kB
Transfer

0 kB
Size

7
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://r041.donnael.com/?S=5&E=2002502&DE=2021-01-27 HTTP 302
    https://r044.donnael.com/?&S=5&E=2002502&DE=2021-01-27&R=d41 HTTP 302
    https://r035.donnael.com/?&S=5&E=2002502&DE=2021-01-27&R=d41d44 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://refpa832816.top/L?tag=s_1841m_355c_&site=1841&ad=355 HTTP 303
  • https://1-xredbet87963.top/?tag=s_1841m_355c_ HTTP 307
  • https://lite-1x0798860.top/?tag=s_1841m_355c_ HTTP 302
  • https://lite-1x0798860.top/de/?tag=s_1841m_355c_ HTTP 302
  • https://lite-1x0798860.top/de/blockPage

2 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
r035.donnael.com/
Redirect Chain
  • http://r041.donnael.com/?S=5&E=2002502&DE=2021-01-27
  • https://r044.donnael.com/?&S=5&E=2002502&DE=2021-01-27&R=d41
  • https://r035.donnael.com/?&S=5&E=2002502&DE=2021-01-27&R=d41d44
23 B
287 B
Document
General
Full URL
https://r035.donnael.com/?&S=5&E=2002502&DE=2021-01-27&R=d41d44
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
194.247.12.182 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
web113.default-host.net
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
5364f73f9d93674f6515a6993a76feeaed28b178db5842159fcec08ce47f9310

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Server
nginx/1.18.0 (Ubuntu)
Date
Sun, 02 Jan 2022 05:58:13 GMT
Content-Type
text/plain; charset=utf8
Content-Length
23
Connection
keep-alive
Refresh
1; url=https://refpa832816.top/L?tag=s_1841m_355c_&site=1841&ad=355

Redirect headers

Server
nginx/1.18.0 (Ubuntu)
Date
Sun, 02 Jan 2022 05:58:13 GMT
Content-Type
text/plain; charset=utf8
Content-Length
23
Connection
keep-alive
Location
https://r035.donnael.com/?&S=5&E=2002502&DE=2021-01-27&R=d41d44
blockPage
lite-1x0798860.top/de/
Redirect Chain
  • https://refpa832816.top/L?tag=s_1841m_355c_&site=1841&ad=355
  • https://1-xredbet87963.top/?tag=s_1841m_355c_
  • https://lite-1x0798860.top/?tag=s_1841m_355c_
  • https://lite-1x0798860.top/de/?tag=s_1841m_355c_
  • https://lite-1x0798860.top/de/blockPage
0
0
Document
General
Full URL
https://lite-1x0798860.top/de/blockPage
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
178.253.36.20 , Iran, Islamic Republic Of, ASN202492 (SGHL1-AS, NL),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains max-age=63072000; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://r035.donnael.com/?&S=5&E=2002502&DE=2021-01-27&R=d41d44

Response headers

server
nginx
date
Sun, 02 Jan 2022 05:58:18 GMT
content-type
text/html; charset=utf-8
accept-ranges
none
content-encoding
gzip
etag
"2a364-uxXpLJmKOT/+iSMtw78uURE9MxA"
server-timing
total;dur=3157;desc="Nuxt Server Time" dt_285;dur=3198
strict-transport-security
max-age=15724800; includeSubDomains max-age=63072000; includeSubDomains; preload
vary
User-Agent, Accept-Encoding

Redirect headers

server
nginx
date
Sun, 02 Jan 2022 05:58:15 GMT
location
/de/blockPage
server-timing
total;dur=778;desc="Nuxt Server Time" dt_285;dur=904
strict-transport-security
max-age=15724800; includeSubDomains max-age=63072000; includeSubDomains; preload
vary
User-Agent

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

7 Cookies

Domain/Path Name / Value
1-xredbet87963.top/ Name: SESSION
Value: a9814525b04b89832265327b84a49e5d
1-xredbet87963.top/ Name: lng
Value: de
1-xredbet87963.top/ Name: flaglng
Value: de
1-xredbet87963.top/ Name: _glhf
Value: 1641120870
lite-1x0798860.top/ Name: platform_type
Value: desktop
lite-1x0798860.top/ Name: auid
Value: sv0kFGHRPvY6b4iQBtwsAg==
lite-1x0798860.top/ Name: lng
Value: de

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1-xredbet87963.top
lite-1x0798860.top
r035.donnael.com
r041.donnael.com
r044.donnael.com
refpa832816.top
178.253.25.121
178.253.25.34
178.253.36.20
194.247.12.182
5364f73f9d93674f6515a6993a76feeaed28b178db5842159fcec08ce47f9310