colorsantaname.ga Open in urlscan Pro
157.245.79.75  Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://cht.secondaryinformtrand.com/det.php Page URL
2. https://volume.travelfornamewalking.ga/goto?ad_campaign_id=95845 Page URL
3. https://colorsantaname.ga/?p=ha2wezbzmi5gi3bpgiztomi&sub1=billow&sub2=billow.buy Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	det.php Show response cht.secondaryinformtrand.com/	2 KB 1 KB	118ms 36ms	Document text/html	45.9.148.154 NICEIT
General Check archive.org Show headers Download Go to Full URL https://cht.secondaryinformtrand.com/det.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 45.9.148.154 , Netherlands, ASN49447 (NICEIT, DM), Reverse DNS Software nginx / Resource Hash e86f72d37ebdee28715950c836ce14cbd264ee5fc499e370cd35994c1cc48596 Request headers :method GET :authority cht.secondaryinformtrand.com :scheme https :path /det.php pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers server nginx date Wed, 06 Jan 2021 03:33:13 GMT content-type text/html;charset=UTF-8 vary Accept-Encoding content-encoding gzip
GET H/1.1	200 OK	local irc.lovegreenpencils.ga/	307 B 1 KB	289ms 98ms	Script application/javascript	95.181.157.242 MSKHOST
General Check archive.org Show headers Download Go to Full URL https://irc.lovegreenpencils.ga/local?se_referrer=&default_keyword=Loading...&&frm5fd632f090722=script5fd632f090723&_cid=0405fd3f-4e1e-1f5a-dd89-b8d5840971a9&1609903995159 Requested by Host: cht.secondaryinformtrand.com URL: https://cht.secondaryinformtrand.com/det.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 95.181.157.242 , Russian Federation, ASN207319 (MSKHOST, RU), Reverse DNS gift.com Software nginx / Resource Hash Request headers Referer https://cht.secondaryinformtrand.com/det.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Pragma no-cache Date Wed, 06 Jan 2021 03:33:15 GMT Last-Modified Wed, 06 Jan 2021 03:33:15 GMT Server nginx Vary Accept-Encoding Content-Type application/javascript Access-Control-Allow-Origin * Cache-Control no-cache, no-store, must-revalidate,post-check=0,pre-check=0 Connection keep-alive Content-Length 307 Expires 0
GET		goto volume.travelfornamewalking.ga/	0 0
GET H/1.1	200 OK	Cookie set goto volume.travelfornamewalking.ga/	767 B 2 KB	280ms 100ms	Document text/html	95.181.157.242 MSKHOST
General Check archive.org Show headers Download Go to Full URL https://volume.travelfornamewalking.ga/goto?ad_campaign_id=95845 Requested by Host: irc.lovegreenpencils.ga URL: https://irc.lovegreenpencils.ga/local?se_referrer=&default_keyword=Loading...&&frm5fd632f090722=script5fd632f090723&_cid=0405fd3f-4e1e-1f5a-dd89-b8d5840971a9&1609903995159 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 95.181.157.242 , Russian Federation, ASN207319 (MSKHOST, RU), Reverse DNS gift.com Software nginx / Resource Hash Request headers Host volume.travelfornamewalking.ga Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest document Referer https://cht.secondaryinformtrand.com/det.php Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://cht.secondaryinformtrand.com/det.php Response headers Server nginx Date Wed, 06 Jan 2021 03:33:15 GMT Content-Type text/html; charset=UTF-8 Content-Length 767 Connection keep-alive Cache-Control no-cache, no-store, must-revalidate,post-check=0,pre-check=0 Expires 0 Last-Modified Wed, 06 Jan 2021 03:33:15 GMT Pragma no-cache Set-Cookie _subid=1u578ni5ff52f7ba8b05;Expires=Saturday, 06-Feb-2021 03:33:15 GMT;Max-Age=2678400;Path=/ d9701=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjJcIjoxNjA5OTAzOTk1LFwiMTJcIjoxNjA5OTAzOTk1fSxcImNhbXBhaWduc1wiOntcIjJcIjoxNjA5OTAzOTk1LFwiNlwiOjE2MDk5MDM5OTV9LFwidGltZVwiOjE2MDk5MDM5OTV9In0.5UX6H61My5XccSgiwTObSLKKjnp05C0HPuCUqg_08sU;Expires=Saturday, 06-Feb-2021 03:33:15 GMT;Max-Age=2678400;Path=/ Vary Accept-Encoding Access-Control-Allow-Origin *
GET H2	200	Primary Request / Show response colorsantaname.ga/	12 KB 12 KB	161ms 55ms	Document text/html	157.245.79.75 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://colorsantaname.ga/?p=ha2wezbzmi5gi3bpgiztomi&sub1=billow&sub2=billow.buy Requested by Host: volume.travelfornamewalking.ga URL: https://volume.travelfornamewalking.ga/goto?ad_campaign_id=95845 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 157.245.79.75 , United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx / Resource Hash 74b4d6e7043e02645b65a45ac018030b2404fd5d2490beafd87e49f10c2fce25 Security Headers Name Value Content-Security-Policy img-src https: data:; upgrade-insecure-requests Strict-Transport-Security max-age=31536000 Request headers :method GET :authority colorsantaname.ga :scheme https :path /?p=ha2wezbzmi5gi3bpgiztomi&sub1=billow&sub2=billow.buy pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest document referer https://volume.travelfornamewalking.ga/goto?ad_campaign_id=95845 accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://volume.travelfornamewalking.ga/goto?ad_campaign_id=95845 Response headers server nginx date Wed, 06 Jan 2021 03:33:15 GMT content-type text/html; charset=UTF-8 access-control-allow-origin * set-cookie uuid=c155b6aa-8f88-4cc4-b562-3e99d394edac; expires=Fri, 05-Feb-2021 03:33:15 GMT; Max-Age=2592000; path=/; domain=colorsantaname.ga strict-transport-security max-age=31536000 content-security-policy img-src https: data:; upgrade-insecure-requests
GET DATA	200 OK	truncated /	748 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash a5308b7decd6fc2d5e8438fb037c4a822125135db832c05437d754655ff2fc23 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

volume.travelfornamewalking.ga

URL

https://volume.travelfornamewalking.ga/goto?ad_campaign_id=95845

24 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated boolean| guardEnabled boolean| isChrome function| compareVersion function| getLanguage object| rootElement boolean| canStart function| text function| textr function| disableHistory function| disableIncognito function| denied function| getWorkerRegistration function| SubS function| CheckS function| urlB64ToUint8Array

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.colorsantaname.ga/	1970-01-19 15:54:55	Name: uuid Value: c155b6aa-8f88-4cc4-b562-3e99d394edac

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cht.secondaryinformtrand.com
colorsantaname.ga
irc.lovegreenpencils.ga
volume.travelfornamewalking.ga
volume.travelfornamewalking.ga
157.245.79.75
45.9.148.154
95.181.157.242
74b4d6e7043e02645b65a45ac018030b2404fd5d2490beafd87e49f10c2fce25
a5308b7decd6fc2d5e8438fb037c4a822125135db832c05437d754655ff2fc23
e86f72d37ebdee28715950c836ce14cbd264ee5fc499e370cd35994c1cc48596