urlscan.io logo urlscan.io
SecurityTrails logo

redbnm.com Open in urlscan Pro
51.195.7.19  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://greencarehealth.com/
Effective URL: https://redbnm.com/cvjvl2k.php?key=hrzhxgf8dpnqh0cqkfca&conversion=KwmBGYMMqBQ&bid=0.045&source_subid=13858479072&b...
Submission: On January 11 via manual from QA — Scanned from CH
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 3 countries across 5 domains to perform 4 HTTP transactions. The main IP is 51.195.7.19, located in France and belongs to OVH, FR. The main domain is redbnm.com.
TLS certificate: Issued by R3 on November 12th 2023. Valid for: 3 months.
This is the only time redbnm.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 81.17.29.148 51852 (PLI-AS)
2 50.17.244.233 14618 (AMAZON-AES)
1 1 173.239.53.32 27257 (WEBAIR-IN...)
1 51.195.7.19 16276 (OVH)
4 3
Apex Domain
Subdomains		 Transfer
2 enlil-syf.com
enlil-syf.com
3 KB
1 redbnm.com
redbnm.com
996 B
1 iforcircles-1.online
xml-v4.iforcircles-1.online
335 B
1 greencarehealth.com
greencarehealth.com
491 B
0 ch-news.org Failed
ch-news.org Failed
4 5
Domain Requested by
2 enlil-syf.com enlil-syf.com
1 redbnm.com enlil-syf.com
1 xml-v4.iforcircles-1.online 1 redirects
1 greencarehealth.com 1 redirects
0 ch-news.org Failed
4 5

This site contains no links.

Subject Issuer Validity Valid
redbnm.com
R3		 2023-11-12 -
2024-02-10		 3 months crt.sh

This page contains 1 frames:

Frame: https://ch-news.org/srf?lpkey=175704be95ea396d69&uclick=15x9sl3y&uclickhash=15x9sl3y-15x9sl3y-3y-3y-fn-b4-nt-741ccf
Frame ID: 2221380907F37C5045EFAEDFD14157C0
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://greencarehealth.com/ HTTP 302
    http://enlil-syf.com/zclkvisitor/ace385b4-b048-11ee-ae35-129c2212399b/72092e88-2c53-401c-b988-51e... Page URL
  2. http://enlil-syf.com/zclkredirect?visitid=ace385b4-b048-11ee-ae35-129c2212399b&type=js&browserWid... Page URL
  3. http://xml-v4.iforcircles-1.online/click?i=CJ8IoBOqSe0_0 HTTP 302
    https://redbnm.com/cvjvl2k.php?key=hrzhxgf8dpnqh0cqkfca&conversion=KwmBGYMMqBQ&bid=0.045&source... Page URL

Page Statistics

4
Requests

25 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

3
IPs

3
Countries

4 kB
Transfer

3 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://greencarehealth.com/ HTTP 302
    http://enlil-syf.com/zclkvisitor/ace385b4-b048-11ee-ae35-129c2212399b/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=acef4580-b048-11ee-ae35-129c2212399b Page URL
  2. http://enlil-syf.com/zclkredirect?visitid=ace385b4-b048-11ee-ae35-129c2212399b&type=js&browserWidth=1600&browserHeight=1200&iframeDetected=false&webdriverDetected=false&usingEventListener=true Page URL
  3. http://xml-v4.iforcircles-1.online/click?i=CJ8IoBOqSe0_0 HTTP 302
    https://redbnm.com/cvjvl2k.php?key=hrzhxgf8dpnqh0cqkfca&conversion=KwmBGYMMqBQ&bid=0.045&source_subid=13858479072&banner=5944748&carrier=Swisscom&IP=178.198.84.218&campaign=1118429&query=greencarehealth%2Cgreencarehealth.com&state=be Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://greencarehealth.com/ HTTP 302
  • http://enlil-syf.com/zclkvisitor/ace385b4-b048-11ee-ae35-129c2212399b/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=acef4580-b048-11ee-ae35-129c2212399b
Request Chain 2
  • https://redbnm.com/cvjvl2k.php?key=hrzhxgf8dpnqh0cqkfca&conversion=KwmBGYMMqBQ&bid=0.045&source_subid=13858479072&banner=5944748&carrier=Swisscom&IP=178.198.84.218&campaign=1118429&query=greencarehealth%2Cgreencarehealth.com&state=be HTTP 302
  • https://ch-news.org/srf?lpkey=175704be95ea396d69&uclick=15x9sl3y&uclickhash=15x9sl3y-15x9sl3y-3y-3y-fn-b4-nt-741ccf

4 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
72092e88-2c53-401c-b988-51ef43ce1034
enlil-syf.com/zclkvisitor/ace385b4-b048-11ee-ae35-129c2212399b/
Redirect Chain
  • http://greencarehealth.com/
  • http://enlil-syf.com/zclkvisitor/ace385b4-b048-11ee-ae35-129c2212399b/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=acef4580-b048-11ee-ae35-129c2212399b
1 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://enlil-syf.com/zclkvisitor/ace385b4-b048-11ee-ae35-129c2212399b/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=acef4580-b048-11ee-ae35-129c2212399b
Protocol
HTTP/1.1
Server
50.17.244.233 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-50-17-244-233.compute-1.amazonaws.com
Software
OliHoWGC /
Resource Hash
03104c73c2ff811d26cf9fe4a9898f5d6311e419de9af69c4f769da2baad316a
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline'
X-Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline'

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

Access-Control-Allow-Headers
X-Requested-With,Content-Type,x-exadsrtb-version,x-openrtb-version,x-zerortb-version,X-Flag
Access-Control-Allow-Methods
GET,POST,OPTIONS
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, pre-check=0, post-check=0
Connection
keep-alive
Content-Type
text/html;charset=UTF-8
Date
Thu, 11 Jan 2024 06:14:28 GMT
Server
OliHoWGC
Transfer-Encoding
chunked
X-WebKit-CSP
default-src 'self'; script-src 'self' 'unsafe-inline'
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline'
x-content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline'

Redirect headers

cache-control
max-age=0, private, must-revalidate
connection
close
content-length
11
date
Thu, 11 Jan 2024 06:14:28 GMT
location
http://enlil-syf.com/zclkvisitor/ace385b4-b048-11ee-ae35-129c2212399b/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=acef4580-b048-11ee-ae35-129c2212399b
server
nginx
zclkredirect
enlil-syf.com/ 		294 B
981 B 		Document
General
Check archive.org
Download Go to
Full URL
http://enlil-syf.com/zclkredirect?visitid=ace385b4-b048-11ee-ae35-129c2212399b&type=js&browserWidth=1600&browserHeight=1200&iframeDetected=false&webdriverDetected=false&usingEventListener=true
Requested by
Host: enlil-syf.com
URL: http://enlil-syf.com/zclkvisitor/ace385b4-b048-11ee-ae35-129c2212399b/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=acef4580-b048-11ee-ae35-129c2212399b
Protocol
HTTP/1.1
Server
50.17.244.233 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-50-17-244-233.compute-1.amazonaws.com
Software
IJKzsScv /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline'
X-Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline'

Request headers

Referer
http://enlil-syf.com/zclkvisitor/ace385b4-b048-11ee-ae35-129c2212399b/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=acef4580-b048-11ee-ae35-129c2212399b
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

Access-Control-Allow-Headers
X-Requested-With,Content-Type,x-exadsrtb-version,x-openrtb-version,x-zerortb-version,X-Flag
Access-Control-Allow-Methods
GET,POST,OPTIONS
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, pre-check=0, post-check=0
Connection
keep-alive
Content-Type
text/html;charset=UTF-8
Date
Thu, 11 Jan 2024 06:14:28 GMT
Server
IJKzsScv
Transfer-Encoding
chunked
X-WebKit-CSP
default-src 'self'; script-src 'self' 'unsafe-inline'
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline'
redirected
JS
x-content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline'
Primary Request cvjvl2k.php
redbnm.com/
Redirect Chain
  • http://xml-v4.iforcircles-1.online/click?i=CJ8IoBOqSe0_0
  • https://redbnm.com/cvjvl2k.php?key=hrzhxgf8dpnqh0cqkfca&conversion=KwmBGYMMqBQ&bid=0.045&source_subid=13858479072&banner=5944748&carrier=Swisscom&IP=178.198.84.218&campaign=1118429&query=greencareh...
1 KB
996 B 		Document
General
Check archive.org
Download Go to
Full URL
https://redbnm.com/cvjvl2k.php?key=hrzhxgf8dpnqh0cqkfca&conversion=KwmBGYMMqBQ&bid=0.045&source_subid=13858479072&banner=5944748&carrier=Swisscom&IP=178.198.84.218&campaign=1118429&query=greencarehealth%2Cgreencarehealth.com&state=be
Requested by
Host: enlil-syf.com
URL: http://enlil-syf.com/zclkredirect?visitid=ace385b4-b048-11ee-ae35-129c2212399b&type=js&browserWidth=1600&browserHeight=1200&iframeDetected=false&webdriverDetected=false&usingEventListener=true
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, CHACHA20_POLY1305
Server
51.195.7.19 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3177896.ip-51-195-7.eu
Software
nginx/1.24.0 /
Resource Hash
936098d5403b2b173dc1241dd9386d51f43b0982c07eb6931361b6c3f6d59577
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
http://enlil-syf.com/zclkredirect?visitid=ace385b4-b048-11ee-ae35-129c2212399b&type=js&browserWidth=1600&browserHeight=1200&iframeDetected=false&webdriverDetected=false&usingEventListener=true
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Thu, 11 Jan 2024 06:14:29 GMT
Server
nginx/1.24.0
Strict-Transport-Security
max-age=31536000
Transfer-Encoding
chunked

Redirect headers

Cache-Control
no-store
Connection
keep-alive
Content-Length
0
Location
https://redbnm.com/cvjvl2k.php?key=hrzhxgf8dpnqh0cqkfca&conversion=KwmBGYMMqBQ&bid=0.045&source_subid=13858479072&banner=5944748&carrier=Swisscom&IP=178.198.84.218&campaign=1118429&query=greencarehealth%2Cgreencarehealth.com&state=be
srf
ch-news.org/
Redirect Chain
  • https://redbnm.com/cvjvl2k.php?key=hrzhxgf8dpnqh0cqkfca&conversion=KwmBGYMMqBQ&bid=0.045&source_subid=13858479072&banner=5944748&carrier=Swisscom&IP=178.198.84.218&campaign=1118429&query=greencareh...
  • https://ch-news.org/srf?lpkey=175704be95ea396d69&uclick=15x9sl3y&uclickhash=15x9sl3y-15x9sl3y-3y-3y-fn-b4-nt-741ccf
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
ch-news.org
URL
https://ch-news.org/srf?lpkey=175704be95ea396d69&uclick=15x9sl3y&uclickhash=15x9sl3y-15x9sl3y-3y-3y-fn-b4-nt-741ccf

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Domain/Path Name / Value
.greencarehealth.com/ Name: sid
Value: acd9526e-b048-11ee-894d-529ed38fe8d2
redbnm.com/ Name: uclick
Value: 15x9sl3y
redbnm.com/ Name: uclickhash
Value: 15x9sl3y-15x9sl3y-3y-3y-fn-b4-nt-741ccf

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline'
X-Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline'

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ch-news.org
enlil-syf.com
greencarehealth.com
redbnm.com
xml-v4.iforcircles-1.online
ch-news.org
173.239.53.32
50.17.244.233
51.195.7.19
81.17.29.148
03104c73c2ff811d26cf9fe4a9898f5d6311e419de9af69c4f769da2baad316a
936098d5403b2b173dc1241dd9386d51f43b0982c07eb6931361b6c3f6d59577