santanabr.nublogin.com

Summary

This website contacted 5 IPs in 3 countries across 5 domains to perform 5 HTTP transactions. The main IP is 192.185.62.150, located in Houston, United States and belongs to UNIFIEDLAYER-AS-1 - Unified Layer, US. The main domain is santanabr.nublogin.com.

This is the only time santanabr.nublogin.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	192.185.62.150 192.185.62.150	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1 - Unified Layer)
1	151.139.237.11 151.139.237.11	33438 (HIGHWINDS2) (HIGHWINDS2 - Highwinds Network Group)
1 1	163.172.46.38 163.172.46.38	12876 (Online SAS) (Online SAS)
1	163.172.47.164 163.172.47.164	12876 (Online SAS) (Online SAS)
1	163.172.58.164 163.172.58.164	12876 (Online SAS) (Online SAS)
1 1	2a00:1450:400... 2a00:1450:4001:817::2013	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:81c::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
5	5

1 192.185.62.150 (Houston, United States)

ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US)

santanabr.nublogin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.139.237.11 (Dallas, United States)

ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US)

cdn.rawgit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 163.172.46.38 (France) 1 redirects

ASN12876 (Online SAS, FR)
PTR: 163-172-46-38.rev.poneytelecom.eu

1.top4top.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 163.172.47.164 (France)

ASN12876 (Online SAS, FR)
PTR: 163-172-47-164.rev.poneytelecom.eu

h.top4top.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 163.172.58.164 (France)

ASN12876 (Online SAS, FR)
PTR: 163-172-58-164.rev.poneytelecom.eu

4.top4top.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:817::2013 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)

arti.master.irhamna.googlepages.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81c::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

sites.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	top4top.net 1 redirects 1.top4top.net h.top4top.net 4.top4top.net	246 KB
1	google.com sites.google.com	523 B
1	googlepages.com 1 redirects arti.master.irhamna.googlepages.com	262 B
1	rawgit.com cdn.rawgit.com	2 KB
1	nublogin.com santanabr.nublogin.com	1 KB
5	5

	Domain	Requested by
1	sites.google.com	santanabr.nublogin.com
1	arti.master.irhamna.googlepages.com	1 redirects
1	4.top4top.net	santanabr.nublogin.com
1	h.top4top.net	santanabr.nublogin.com
1	1.top4top.net	1 redirects
1	cdn.rawgit.com	santanabr.nublogin.com
1	santanabr.nublogin.com
5	7

This site contains links to these domains. Also see Links.

Domain
wpplugins.info
www.facebook.com

Subject Issuer	Validity	Valid
rawgit.com COMODO RSA Domain Validation Secure Server CA	`2018-12-29` - `2020-01-13`	a year	crt.sh
*.top4top.net AlphaSSL CA - SHA256 - G2	`2018-03-03` - `2020-04-03`	2 years	crt.sh
*.google.com GTS CA 1O1	`2019-10-03` - `2019-12-26`	3 months	crt.sh

This page contains 2 frames:

Primary Page: http://santanabr.nublogin.com/
Frame ID: 3AC9BA9BA95209490D8ABA96C5640713
Requests: 4 HTTP requests in this frame

Frame: https://h.top4top.net/m_1350orkxl0.mp3
Frame ID: E9DFC2AB7A48F93231B8D3242813ABE8
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

5
Requests

80 %
HTTPS

29 %
IPv6

5
Domains

7
Subdomains

5
IPs

3
Countries

249 kB
Transfer

251 kB
Size

1
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: http://wpplugins.info/

Search URL Search Domain Scan URL

URL: https://www.facebook.com/susuKNTLmanisz
Title: Hacked By prizeHdru { Indonesia Silent Coders }

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

https://1.top4top.net/m_1350orkxl0.mp3 HTTP 302
https://h.top4top.net/m_1350orkxl0.mp3

Request Chain 3

http://arti.master.irhamna.googlepages.com/snow.gif HTTP 301
http://sites.google.com/site/artimasterirhamna/snow.gif HTTP 307
https://sites.google.com/site/artimasterirhamna/snow.gif

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
santanabr.nublogin.com/ 2 KB
1 KB 787ms
555ms Document
text/html 192.185.62.150
Unified Layer

General

Check archive.org

Show headers Download Go to

Full URL: http://santanabr.nublogin.com/
Protocol: HTTP/1.1
Server: 192.185.62.150 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS
Software: Apache /
Resource Hash: a54eaaf9ef098c87943b93e75516be9056efa8fa7ab87bbd1d741055b7be1592

Request headers

Host: santanabr.nublogin.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 21 Oct 2019 08:27:35 GMT
Server: Apache
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1191
Keep-Alive: timeout=5, max=75
Content-Type: text/html; charset=UTF-8

GET
H2 200 daun-berguguran.js Show response
cdn.rawgit.com/bungfrangki/efeksalju/2a7805c7/ 4 KB
2 KB 19ms
5ms Script
application/javascript 151.139.237.11
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.rawgit.com/bungfrangki/efeksalju/2a7805c7/daun-berguguran.js

Requested by

Host: santanabr.nublogin.com
URL: http://santanabr.nublogin.com/

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.139.237.11 Dallas, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),

Reverse DNS

Software

NetDNA-cache/2.2 /

Resource Hash

4487a8e0088b0bc897cfbdef37bf2f50573d7f352ea12a4ad989854dd69cea24

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload, max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://santanabr.nublogin.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 08:27:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
cf-ray: 484a0d50dc4796be-FRA
x-cache: HIT
status: 200
vary: Accept-Encoding
rawgit-cache-status: MISS
content-type: application/javascript;charset=utf-8
server: NetDNA-cache/2.2
etag: W/"312f730bdaec1da3dc7072026d334f016e69bcdd"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; preload, max-age=31536000; preload
sunset: Tue, 01 Oct 2019 00:00:00 GMT
access-control-allow-origin: *
cache-control: max-age=315569000, immutable
x-robots-tag: none
link: <https://rawgit.com/>; rel="sunset"; title="RawGit will soon shut down. Please stop using it."

GET
H/1.1

200
OK

Cookie set m_1350orkxl0.mp3
h.top4top.net/ Frame E9DF
Redirect Chain

https://1.top4top.net/m_1350orkxl0.mp3
https://h.top4top.net/m_1350orkxl0.mp3

0
0

109ms
36ms

Document
audio/mpeg

163.172.47.164
Online SAS

General

Check archive.org

Show headers Download Go to

Full URL

https://h.top4top.net/m_1350orkxl0.mp3

Requested by

Host: santanabr.nublogin.com
URL: http://santanabr.nublogin.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

163.172.47.164 , France, ASN12876 (Online SAS, FR),

Reverse DNS

163-172-47-164.rev.poneytelecom.eu

Software

HotCores /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Request headers

Host: h.top4top.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Referer: http://santanabr.nublogin.com/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: http://santanabr.nublogin.com/

Response headers

Server: HotCores
Date: Mon, 21 Oct 2019 08:27:36 GMT
Content-Type: audio/mpeg
Content-Length: 7916493
Connection: close
Set-Cookie: klj_40d147_downloads=hm9w0; Max-Age=86400; Domain=.top4top.net; Path=/; Expires=Tue, 22 Oct 2019 08:27:36 GMT
Last-Modified: Thu, 12 Sep 2019 13:19:11 GMT
Content-Disposition: inline; filename="%5BAMV%5D%20Koe%20No%20Katachi%20-%20Haiiro%20to%20Ao.mp3"
ETag: "5d7a45cf-78cbcd"
Expires: Mon, 21 Oct 2019 10:27:36 GMT
Cache-Control: max-age=7200
X-File-ID: x29592720x
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Accept-Ranges: bytes

Redirect headers

Server: HotCores
Date: Mon, 21 Oct 2019 08:27:35 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 120
Connection: close
Location: https://h.top4top.net/m_1350orkxl0.mp3
Vary: Accept
Strict-Transport-Security: max-age=31536000; includeSubdomains;

GET
H/1.1 200
OK p_13505mghf0.jpg
4.top4top.net/ 245 KB
245 KB 97ms
36ms Image
image/jpeg 163.172.58.164
Online SAS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://4.top4top.net/p_13505mghf0.jpg

Requested by

Host: santanabr.nublogin.com
URL: http://santanabr.nublogin.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

163.172.58.164 , France, ASN12876 (Online SAS, FR),

Reverse DNS

163-172-58-164.rev.poneytelecom.eu

Software

HotCores /

Resource Hash

196ed067fb318f90e77943d2ff8cda451ba83a9194fe3c9e6d3d01e265af6efd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://santanabr.nublogin.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-File-ID: x29592495x
Date: Mon, 21 Oct 2019 08:27:35 GMT
Last-Modified: Thu, 12 Sep 2019 13:01:37 GMT
Server: HotCores
ETag: "5d7a41b1-3d319"
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Content-Type: image/jpeg
Cache-Control: max-age=7200
Content-Disposition: inline; filename="FB_IMG_15655045340019014.jpg"
Connection: close
Accept-Ranges: bytes
Content-Length: 250649
Expires: Mon, 21 Oct 2019 10:27:35 GMT

GET
H2

200

snow.gif
sites.google.com/site/artimasterirhamna/
Redirect Chain

http://arti.master.irhamna.googlepages.com/snow.gif
http://sites.google.com/site/artimasterirhamna/snow.gif
https://sites.google.com/site/artimasterirhamna/snow.gif

144 B
523 B

144ms
124ms

Image
image/gif

2a00:1450:4001:81c::200e
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sites.google.com/site/artimasterirhamna/snow.gif

Requested by

Host: santanabr.nublogin.com
URL: http://santanabr.nublogin.com/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

GSE /

Resource Hash

9b45222bd0a2e45994cb629dae53ce5c54d50164f4baa5691ab9253c8cb354b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://santanabr.nublogin.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 21 Oct 2019 08:27:36 GMT
x-content-type-options: nosniff
last-modified: Sun, 15 Dec 2013 00:32:39 GMT
server: GSE
etag: "1387067559492"
x-frame-options: SAMEORIGIN
content-type: image/gif
status: 200
cache-control: no-cache, no-store, max-age=0, must-revalidate
x-robots-tag: noarchive
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 144
x-xss-protection: 1; mode=block
expires: Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://sites.google.com/site/artimasterirhamna/snow.gif
Non-Authoritative-Reason: HSTS

Verdicts & Comments Add Verdict or Comment

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.top4top.net/	1970-01-19 04:35:32	Name: klj_40d147_downloads Value: hm9w0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1.top4top.net
4.top4top.net
arti.master.irhamna.googlepages.com
cdn.rawgit.com
h.top4top.net
santanabr.nublogin.com
sites.google.com
151.139.237.11
163.172.46.38
163.172.47.164
163.172.58.164
192.185.62.150
2a00:1450:4001:817::2013
2a00:1450:4001:81c::200e
196ed067fb318f90e77943d2ff8cda451ba83a9194fe3c9e6d3d01e265af6efd
4487a8e0088b0bc897cfbdef37bf2f50573d7f352ea12a4ad989854dd69cea24
9b45222bd0a2e45994cb629dae53ce5c54d50164f4baa5691ab9253c8cb354b8
a54eaaf9ef098c87943b93e75516be9056efa8fa7ab87bbd1d741055b7be1592

santanabr.nublogin.com Open in urlscan Pro 192.185.62.150 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

5 Requests

80 %HTTPS

29 %IPv6

5 Domains

7 Subdomains

5 IPs

3 Countries

249 kBTransfer

251 kBSize

1 Cookies

2 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

20 JavaScript Global Variables

1 Cookies

Indicators

santanabr.nublogin.com Open in urlscan Pro
192.185.62.150 Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

80 %
HTTPS

29 %
IPv6

5
Domains

7
Subdomains

5
IPs

3
Countries

249 kB
Transfer

251 kB
Size

1
Cookies

5 HTTP transactions
0 data transactions