URL: https://novaku.altervista.org/
Submission: On January 11 via api from US — Scanned from US

Summary

This website contacted 8 IPs in 3 countries across 5 domains to perform 12 HTTP transactions. The main IP is 5.9.139.206, located in Bonndorf, Germany and belongs to HETZNER-AS, DE. The main domain is novaku.altervista.org.
TLS certificate: Issued by R3 on December 4th 2023. Valid for: 3 months.
This is the only time novaku.altervista.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 5.9.139.206 24940 (HETZNER-AS)
1 2607:f8b0:400... 15169 (GOOGLE)
1 2600:9000:262... 16509 (AMAZON-02)
1 148.251.182.35 24940 (HETZNER-AS)
1 52.48.134.75 16509 (AMAZON-02)
2 52.84.193.215 16509 (AMAZON-02)
2 23.51.57.13 16625 (AKAMAI-AS)
12 8
Apex Domain
Subdomains
Transfer
4 altervista.org
novaku.altervista.org
im.altervista.org
it.altervista.org Failed
en.altervista.org Failed
en.ad.altervista.org
43 KB
2 pubmatic.com
ads.pubmatic.com — Cisco Umbrella Rank: 811
160 KB
2 amazon-adsystem.com
c.amazon-adsystem.com — Cisco Umbrella Rank: 359
73 KB
1 admantx.com
euasync01.admantx.com — Cisco Umbrella Rank: 31610
341 B
1 blogspot.com
4.bp.blogspot.com — Cisco Umbrella Rank: 16814
64 KB
12 5
Domain Requested by
2 ads.pubmatic.com en.ad.altervista.org
ads.pubmatic.com
2 c.amazon-adsystem.com en.ad.altervista.org
c.amazon-adsystem.com
2 novaku.altervista.org novaku.altervista.org
1 euasync01.admantx.com en.ad.altervista.org
1 en.ad.altervista.org novaku.altervista.org
1 im.altervista.org novaku.altervista.org
1 4.bp.blogspot.com novaku.altervista.org
0 en.altervista.org Failed novaku.altervista.org
0 it.altervista.org Failed novaku.altervista.org
12 9

This site contains links to these domains. Also see Links.

Domain
4.bp.blogspot.com
www.theatregelap.com
en.altervista.org
Subject Issuer Validity Valid
amoreisto.altervista.org
R3
2023-12-04 -
2024-03-03
3 months crt.sh
misc-sni.blogspot.com
GTS CA 1C3
2023-11-20 -
2024-02-12
3 months crt.sh
im.altervista.org
Amazon RSA 2048 M03
2024-01-08 -
2025-02-05
a year crt.sh
en.ad.altervista.org
GeoTrust TLS RSA CA G1
2023-06-13 -
2024-07-13
a year crt.sh
*.admantx.com
SSL.com RSA SSL subCA
2023-04-18 -
2024-05-18
a year crt.sh
c.amazon-adsystem.com
Amazon RSA 2048 M01
2023-02-28 -
2024-02-17
a year crt.sh
*.pubmatic.com
DigiCert TLS RSA SHA256 2020 CA1
2023-11-26 -
2024-11-26
a year crt.sh

This page contains 1 frames:

Primary Page: https://novaku.altervista.org/
Frame ID: 434BE7A892188E942ACC35A1BB03E8FF
Requests: 12 HTTP requests in this frame

Screenshot

Page Title

Homepage

Detected technologies

Overall confidence: 100%
Detected patterns
  • <(?:param|embed|iframe)[^>]+youtube(?:-nocookie)?\.com/(?:v|embed)

Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.pubmatic\.com

Page Statistics

12
Requests

67 %
HTTPS

29 %
IPv6

5
Domains

9
Subdomains

8
IPs

3
Countries

340 kB
Transfer

912 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
novaku.altervista.org/
5 KB
2 KB
Document
General
Full URL
https://novaku.altervista.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
5.9.139.206 Bonndorf, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
ns607.altervista.org
Software
Apache /
Resource Hash
8015cf201be73b762f603554471312475b0f51c35227722d731d6447a39d630d

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

accept-ranges
bytes
content-encoding
gzip
content-length
2237
content-type
text/html
date
Thu, 11 Jan 2024 13:12:42 GMT
etag
"15ad-6048c1eabd2c6-gzip"
last-modified
Mon, 04 Sep 2023 17:48:36 GMT
server
Apache
vary
Accept-Encoding
style.css
novaku.altervista.org/
2 KB
670 B
Stylesheet
General
Full URL
https://novaku.altervista.org/style.css
Requested by
Host: novaku.altervista.org
URL: https://novaku.altervista.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
5.9.139.206 Bonndorf, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
ns607.altervista.org
Software
Apache /
Resource Hash
c6fbe29d66ff2aa143872ffec07186e3a495a6474cca4fabc8434d1c74198c21

Request headers

accept-language
en-US,en;q=0.9
Referer
https://novaku.altervista.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Thu, 11 Jan 2024 13:12:42 GMT
content-encoding
gzip
last-modified
Wed, 26 Sep 2012 04:52:26 GMT
server
Apache
etag
"71b-4ca9396cf1680-gzip"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=2592000
accept-ranges
bytes
content-length
549
expires
Sat, 10 Feb 2024 13:12:42 GMT
backdoored+detected.png
4.bp.blogspot.com/-x9U1FrdD43w/UENcvlWWMWI/AAAAAAAAAJk/lkHoGo2zKPU/s320/
63 KB
64 KB
Image
General
Full URL
https://4.bp.blogspot.com/-x9U1FrdD43w/UENcvlWWMWI/AAAAAAAAAJk/lkHoGo2zKPU/s320/backdoored+detected.png
Requested by
Host: novaku.altervista.org
URL: https://novaku.altervista.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:821::2001 Colchester, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
1f16b112415b51f3f81d7064804d54d738450a4963912155ca4dcead1f3ef874
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-US,en;q=0.9
Referer
https://novaku.altervista.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Thu, 11 Jan 2024 13:12:42 GMT
x-content-type-options
nosniff
server
fife
etag
"v255"
vary
Origin
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
content-disposition
inline;filename="backdoored detected.png"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
64975
x-xss-protection
0
expires
Fri, 12 Jan 2024 13:12:42 GMT
alter_300x250.gif
im.altervista.org/adv/
12 KB
13 KB
Image
General
Full URL
https://im.altervista.org/adv/alter_300x250.gif
Requested by
Host: novaku.altervista.org
URL: https://novaku.altervista.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:262a:cc00:8:e12e:9080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
2fa0a3280e4ebb152f20e866416f33cc69e73bba522a739b2bba25bc073964bf

Request headers

accept-language
en-US,en;q=0.9
Referer
https://novaku.altervista.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Thu, 11 Jan 2024 11:15:11 GMT
via
1.1 b8d17fb37d43a7408dc92e906fd36568.cloudfront.net (CloudFront)
last-modified
Wed, 09 Feb 2022 14:23:38 GMT
server
nginx
x-amz-cf-pop
CDG52-P6
age
7051
etag
"6203ce6a-317f"
x-cache
Hit from cloudfront
content-type
image/gif
accept-ranges
bytes
content-length
12671
x-amz-cf-id
T-vHgInaWzAIgjQBIN4dvY2hx8QG95Bv_nlsIh8-swafXY8O_-wqsg==
layout.css
it.altervista.org/css/alterpages/
0
0

common.php
en.altervista.org/alterpages/
0
0

/
en.ad.altervista.org/js.ad/size=300X250/
27 KB
27 KB
Script
General
Full URL
https://en.ad.altervista.org/js.ad/size=300X250/?ref=novaku.altervista.org%2F&r=1704978762311
Requested by
Host: novaku.altervista.org
URL: https://novaku.altervista.org/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
148.251.182.35 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
st31.altervista.org
Software
adserver /
Resource Hash
d8a84bb565707c51878d300c247ae51805681a301fae0481e78104c8b49d5c19

Request headers

accept-language
en-US,en;q=0.9
Referer
https://novaku.altervista.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 11 Jan 2024 13:12:42 GMT
Cache-Control
no-cache
Server
adserver
Content-Length
27655
Content-Type
application/x-javascript
service
euasync01.admantx.com/admantx/
195 B
341 B
Script
General
Full URL
https://euasync01.admantx.com/admantx/service?request=%7B%22key%22%3A%2269abaf6b2f7ca5773c43d4f4659194c6e187d375e984ac967929bcd50f0670bc%22%2C%22method%22%3A%22descriptor%22%2C%22filter%22%3A%22default%22%2C%22decorator%22%3A%22template.altervista%22%2C%22type%22%3A%22URL%22%2C%22mode%22%3A%22async%22%2C%22body%22%3A%22https%3A%2F%2Fnovaku.altervista.org%2F%22%7D
Requested by
Host: en.ad.altervista.org
URL: https://en.ad.altervista.org/js.ad/size=300X250/?ref=novaku.altervista.org%2F&r=1704978762311
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.48.134.75 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-48-134-75.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
1a0536b7a9b75c77988a9c43f55f08b2b727258ecb4dd24d07327341fbcea3f7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-US,en;q=0.9
Referer
https://novaku.altervista.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

access-control-allow-origin
*
date
Thu, 11 Jan 2024 13:12:43 GMT
strict-transport-security
max-age=31536000
server
nginx
content-length
195
content-type
text/plain; charset=UTF-8
apstag.js
c.amazon-adsystem.com/aax2/
282 KB
70 KB
Script
General
Full URL
https://c.amazon-adsystem.com/aax2/apstag.js
Requested by
Host: en.ad.altervista.org
URL: https://en.ad.altervista.org/js.ad/size=300X250/?ref=novaku.altervista.org%2F&r=1704978762311
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.84.193.215 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-84-193-215.cdg52.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
99c6eb6c3f17d69837d604201ac0453a5677eef91484aee37e72dff818ddadbc

Request headers

accept-language
en-US,en;q=0.9
Referer
https://novaku.altervista.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Thu, 11 Jan 2024 13:08:54 GMT
content-encoding
gzip
via
1.1 11a78ce92a548aac13fb6ee545aff014.cloudfront.net (CloudFront), 1.1 a5b64a1ac22cdce92ad57684d05480be.cloudfront.net (CloudFront)
last-modified
Tue, 12 Dec 2023 22:20:11 GMT
server
AmazonS3
x-amz-cf-pop
FRA60-P1, CDG52-P1
age
230
x-amz-server-side-encryption
AES256
etag
W/"bab82e5d8801f394c1ef53a45dc29542"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=3600
x-amz-cf-id
9IqMU7cBCrFAw9EW_mAC__DhwE-SO7QN0m3IPBeK9sqWNILO5DxLJw==
pwt.js
ads.pubmatic.com/AdServer/js/pwt/76492/7133/
514 KB
159 KB
Script
General
Full URL
https://ads.pubmatic.com/AdServer/js/pwt/76492/7133/pwt.js
Requested by
Host: en.ad.altervista.org
URL: https://en.ad.altervista.org/js.ad/size=300X250/?ref=novaku.altervista.org%2F&r=1704978762311
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.51.57.13 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-51-57-13.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
9a3a02c1e5d716b6439644d983333bb11c336b62cbc14a980fc8ed565c272d06

Request headers

accept-language
en-US,en;q=0.9
Referer
https://novaku.altervista.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Thu, 11 Jan 2024 13:12:43 GMT
content-encoding
gzip
last-modified
Tue, 23 May 2023 17:04:54 GMT
server
Apache
vary
Accept-Encoding
content-type
application/javascript
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
max-age=164606
accept-ranges
bytes
content-length
162347
expires
Sat, 13 Jan 2024 10:56:09 GMT
floors.json
ads.pubmatic.com/AdServer/js/pwt/floors/76492/7133/
214 B
586 B
XHR
General
Full URL
https://ads.pubmatic.com/AdServer/js/pwt/floors/76492/7133/floors.json
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/76492/7133/pwt.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.51.57.13 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-51-57-13.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
0892f7166677e3696f6e8df99b3f67e714bd5b0ba6d691b30874876bb6353d15

Request headers

Referer
https://novaku.altervista.org/
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
Content-Type
text/plain

Response headers

date
Thu, 11 Jan 2024 13:12:44 GMT
content-encoding
gzip
last-modified
Wed, 10 Jan 2024 16:28:39 GMT
server
Apache
vary
Accept-Encoding
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
access-control-allow-origin
*
content-type
application/json
cache-control
public, max-age=14400
access-control-allow-credentials
true
accept-ranges
bytes
content-length
179
expires
Thu, 11 Jan 2024 17:12:44 GMT
aps_csm.js
c.amazon-adsystem.com/bao-csm/aps-comm/
6 KB
3 KB
XHR
General
Full URL
https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.84.193.215 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-84-193-215.cdg52.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language
en-US,en;q=0.9
Referer
https://novaku.altervista.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Thu, 11 Jan 2024 13:12:45 GMT
x-amz-version-id
9yABOonr2HqHtwbarUcdbIqN0f4A8Qog
content-encoding
gzip
via
1.1 a5b64a1ac22cdce92ad57684d05480be.cloudfront.net (CloudFront)
x-amz-cf-pop
CDG52-P1
x-amz-server-side-encryption
AES256
x-cache
Miss from cloudfront
last-modified
Tue, 29 Aug 2023 08:30:37 GMT
server
AmazonS3
etag
W/"a4d296427fc806b21335359e398c025c"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
vary
Accept-Encoding,Origin
x-amz-cf-id
A_BBmFpCrpnPefkqGgkGpWR8ZED7e81SjXVt9RF2kiz1Za-L5uqlKA==

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
it.altervista.org
URL
http://it.altervista.org/css/alterpages/layout.css
Domain
en.altervista.org
URL
http://en.altervista.org/alterpages/common.php

Verdicts & Comments Add Verdict or Comment

25 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| documentPictureInPicture undefined| _gaq number| av_adsense_flag object| avadv object| adsbygoogle string| ADX_label string| ADX_lemmas string| ADX_people string| ADX_companies string| ADX_places string| ADX_categories object| googletag object| PWT object| owpbjsChunk object| owpbjs object| _pbjsGlobals object| partnersWithoutErrorAndBids object| matchedimpressions object| ucTag object| OWT object| _aps boolean| apstagLOADED object| apstag

0 Cookies

7 Console Messages

Source Level URL
Text
security warning URL: https://novaku.altervista.org/
Message:
Mixed Content: The page at 'https://novaku.altervista.org/' was loaded over HTTPS, but requested an insecure element 'http://4.bp.blogspot.com/-x9U1FrdD43w/UENcvlWWMWI/AAAAAAAAAJk/lkHoGo2zKPU/s320/backdoored+detected.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security warning URL: https://novaku.altervista.org/
Message:
Mixed Content: The page at 'https://novaku.altervista.org/' was loaded over HTTPS, but requested an insecure element 'http://im.altervista.org/adv/alter_300x250.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security error URL: https://novaku.altervista.org/(Line 7)
Message:
Mixed Content: The page at 'https://novaku.altervista.org/' was loaded over HTTPS, but requested an insecure stylesheet 'http://it.altervista.org/css/alterpages/layout.css'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://novaku.altervista.org/
Message:
Mixed Content: The page at 'https://novaku.altervista.org/' was loaded over HTTPS, but requested an insecure script 'http://en.altervista.org/alterpages/common.php'. This request has been blocked; the content must be served over HTTPS.
security warning URL: https://novaku.altervista.org/(Line 133)
Message:
Mixed Content: The page at 'https://novaku.altervista.org/' was loaded over HTTPS, but requested an insecure element 'http://4.bp.blogspot.com/-x9U1FrdD43w/UENcvlWWMWI/AAAAAAAAAJk/lkHoGo2zKPU/s320/backdoored+detected.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security warning URL: https://novaku.altervista.org/(Line 133)
Message:
Mixed Content: The page at 'https://novaku.altervista.org/' was loaded over HTTPS, but requested an insecure element 'http://im.altervista.org/adv/alter_300x250.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security error URL: https://novaku.altervista.org/(Line 63)
Message:
Mixed Content: The page at 'https://novaku.altervista.org/' was loaded over HTTPS, but requested an insecure frame 'http://www.youtube.com/embed/djQkEnRrKOk'. This request has been blocked; the content must be served over HTTPS.