0.greenskymotions.net Open in urlscan Pro
185.177.94.152 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://kersoninvestments.com/
Effective URL:
https://0.greenskymotions.net/index.php?p=mu4genjugq5dcmjrhe3a&sub2=dfastspeed14
Submission: On December 15 via api (December 15th 2022, 2:15:11 pm UTC) from US — Scanned from US

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 5 domains to perform 8 HTTP transactions. The main IP is 185.177.94.152, located in Amsterdam, Netherlands and belongs to ADVANCEDHOSTERS-AS, NL. The main domain is 0.greenskymotions.net.
TLS certificate: Issued by R3 on December 10th 2022. Valid for: 3 months.

This is the only time 0.greenskymotions.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	109.234.164.89 109.234.164.89	50474 (O2SWITCH) (O2SWITCH)
1	91.211.91.114 91.211.91.114	206638 (HOSTFORY) (HOSTFORY)
1	91.211.91.104 91.211.91.104	206638 (HOSTFORY) (HOSTFORY)
2	185.177.94.152 185.177.94.152	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
1	185.177.92.179 185.177.92.179	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
8	6

1 109.234.164.89 (France)

ASN50474 (O2SWITCH, FR)
PTR: 109-234-164-89.reverse.odns.fr

kersoninvestments.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 91.211.91.114 (Ukraine)

ASN206638 (HOSTFORY, UA)

new.weatherplllatform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 91.211.91.104 (Ukraine)

ASN206638 (HOSTFORY, UA)

away.cdnbestplatform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.177.94.152 (Amsterdam, Netherlands)

ASN39572 (ADVANCEDHOSTERS-AS, NL)
PTR: ip-185-177-94-152.ah-server.com

greenskymotions.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
0.greenskymotions.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.177.92.179 (Amsterdam, Netherlands)

ASN39572 (ADVANCEDHOSTERS-AS, NL)
PTR: ip-185-177-92-179.ah-server.com

di4.biz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	greenskymotions.net greenskymotions.net Failed 0.greenskymotions.net	30 KB
1	di4.biz di4.biz	265 B
1	cdnbestplatform.com away.cdnbestplatform.com Failed	553 B
1	weatherplllatform.com new.weatherplllatform.com	1 KB
1	kersoninvestments.com kersoninvestments.com	343 B
8	5

	Domain	Requested by
1	di4.biz	kersoninvestments.com
1	0.greenskymotions.net	kersoninvestments.com
1	greenskymotions.net	away.cdnbestplatform.com
1	away.cdnbestplatform.com	new.weatherplllatform.com
1	new.weatherplllatform.com	kersoninvestments.com
1	kersoninvestments.com
8	6

This site contains no links.

Subject Issuer	Validity	Valid
new.weatherplllatform.com R3	`2022-10-25` - `2023-01-23`	3 months	crt.sh
away.cdnbestplatform.com R3	`2022-10-27` - `2023-01-25`	3 months	crt.sh
greenskymotions.com R3	`2022-12-10` - `2023-03-10`	3 months	crt.sh
di4.biz R3	`2022-11-27` - `2023-02-25`	3 months	crt.sh

This page contains 1 frames:

Frame: https://di4.biz/?auf=mvrwgzjzgq5dcnrqgixtcmjrhe3c6mjzf5tdkmtfmrrdinjpgezc6mjwg4ytcmjtg4ydm&p=b&sub1=&sub2=dfastspeed14&sub3=&sub4=&cpc=0&cpm=0
Frame ID: 0A08AF50A5AD5722EA376E7AA117C1B2
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://kersoninvestments.com/ Page URL
https://away.cdnbestplatform.com/go.php?id=3245467-34-56736-11 Page URL
https://greenskymotions.net/go/mu4genjugq5dcmjrhe3a?sub2=dfastspeed14 Page URL
https://0.greenskymotions.net/index.php?p=mu4genjugq5dcmjrhe3a&sub2=dfastspeed14 Page URL

Page Statistics

8
Requests

63 %
HTTPS

0 %
IPv6

5
Domains

6
Subdomains

6
IPs

3
Countries

32 kB
Transfer

33 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://kersoninvestments.com/ Page URL
https://away.cdnbestplatform.com/go.php?id=3245467-34-56736-11 Page URL
https://greenskymotions.net/go/mu4genjugq5dcmjrhe3a?sub2=dfastspeed14 Page URL
https://0.greenskymotions.net/index.php?p=mu4genjugq5dcmjrhe3a&sub2=dfastspeed14 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK / Show response
kersoninvestments.com/ 97 B
343 B 899ms
595ms Document
text/html 109.234.164.89
O2SWITCH

General

Check archive.org

Show headers Download Go to

Full URL: http://kersoninvestments.com/
Protocol: HTTP/1.1
Server: 109.234.164.89 , France, ASN50474 (O2SWITCH, FR),
Reverse DNS: 109-234-164-89.reverse.odns.fr
Software: o2switch-PowerBoost-v3 /
Resource Hash: 9254142ec66d2ce1d2f2b3a632b952e58dd587308ce99a7557f54380c5529457

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Thu, 15 Dec 2022 14:14:58 GMT
Server: o2switch-PowerBoost-v3
Transfer-Encoding: chunked
Vary: Accept-Encoding

GET
H2 200 pick.js Show response
new.weatherplllatform.com/ 2 KB
1 KB 749ms
124ms Script
application/javascript 91.211.91.114
HOSTFORY

General

Check archive.org

Show headers Download Go to

Full URL: https://new.weatherplllatform.com/pick.js?v=6.66.3
Requested by: Host: kersoninvestments.com
URL: http://kersoninvestments.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 91.211.91.114 , Ukraine, ASN206638 (HOSTFORY, UA),
Reverse DNS
Software: nginx /
Resource Hash: af8b20e40e19ff4a8c23e6d714c04934c802e83dd397f79795aa5a3b684f8b7f

Request headers

accept-language: en-US,en;q=0.9
Referer: http://kersoninvestments.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 14:14:59 GMT
content-encoding: gzip
last-modified: Thu, 27 Oct 2022 17:28:29 GMT
server: nginx
etag: W/"635abfbd-921"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET go.php
away.cdnbestplatform.com/ 0
0

GET
H2 200 go.php
away.cdnbestplatform.com/ 828 B
553 B 2045ms
521ms Document
text/html 91.211.91.104
HOSTFORY

General

Check archive.org

Show headers Download Go to

Full URL

https://away.cdnbestplatform.com/go.php?id=3245467-34-56736-11

Requested by

Host: new.weatherplllatform.com
URL: https://new.weatherplllatform.com/pick.js?v=6.66.3

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

91.211.91.104 , Ukraine, ASN206638 (HOSTFORY, UA),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;

Request headers

Referer: http://kersoninvestments.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

content-encoding: gzip
content-length: 410
content-type: text/html; charset=UTF-8
date: Thu, 15 Dec 2022 14:15:01 GMT
server: nginx
strict-transport-security: max-age=15768000;
vary: Accept-Encoding

GET mu4genjugq5dcmjrhe3a
greenskymotions.net/go/ 0
0

GET
H2 200 mu4genjugq5dcmjrhe3a Show response
greenskymotions.net/go/ 18 KB
18 KB 3740ms
88ms Document
text/html 185.177.94.152
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://greenskymotions.net/go/mu4genjugq5dcmjrhe3a?sub2=dfastspeed14

Requested by

Host: away.cdnbestplatform.com
URL: https://away.cdnbestplatform.com/go.php?id=3245467-34-56736-11

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.177.94.152 Amsterdam, Netherlands, ASN39572 (ADVANCEDHOSTERS-AS, NL),

Reverse DNS

ip-185-177-94-152.ah-server.com

Software

nginx /

Resource Hash

ed9e4bd723e8b906c9b2d3b20aaaa7700c5c78fb850539af3080fed7fb187eb1

Security Headers

Name	Value
Content-Security-Policy	img-src https: data:; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://away.cdnbestplatform.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-origin: *
content-security-policy: img-src https: data:; upgrade-insecure-requests
content-type: text/html; charset=UTF-8
date: Thu, 15 Dec 2022 14:15:05 GMT
server: nginx
strict-transport-security: max-age=31536000

GET
H2 200 Primary Request index.php Show response
0.greenskymotions.net/ 12 KB
12 KB 753ms
88ms Document
text/html 185.177.94.152
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://0.greenskymotions.net/index.php?p=mu4genjugq5dcmjrhe3a&sub2=dfastspeed14

Requested by

Host: kersoninvestments.com
URL: http://kersoninvestments.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.177.94.152 Amsterdam, Netherlands, ASN39572 (ADVANCEDHOSTERS-AS, NL),

Reverse DNS

ip-185-177-94-152.ah-server.com

Software

nginx /

Resource Hash

42c769853ecc4db7a7b8829904c83c4fa1585591dce029c437af88dea06957b9

Security Headers

Name	Value
Content-Security-Policy	img-src https: data:; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://greenskymotions.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-origin: *
content-security-policy: img-src https: data:; upgrade-insecure-requests
content-type: text/html; charset=UTF-8
date: Thu, 15 Dec 2022 14:15:06 GMT
server: nginx
strict-transport-security: max-age=31536000

GET
DATA 200
OK truncated
/ 748 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a5308b7decd6fc2d5e8438fb037c4a822125135db832c05437d754655ff2fc23

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 / Show response
di4.biz/ 0
265 B 484ms
299ms Document
text/html 185.177.92.179
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://di4.biz/?auf=mvrwgzjzgq5dcnrqgixtcmjrhe3c6mjzf5tdkmtfmrrdinjpgezc6mjwg4ytcmjtg4ydm&p=b&sub1=&sub2=dfastspeed14&sub3=&sub4=&cpc=0&cpm=0

Requested by

Host: kersoninvestments.com
URL: http://kersoninvestments.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.177.92.179 Amsterdam, Netherlands, ASN39572 (ADVANCEDHOSTERS-AS, NL),

Reverse DNS

ip-185-177-92-179.ah-server.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	img-src https: data:; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://0.greenskymotions.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-origin: *
content-security-policy: img-src https: data:; upgrade-insecure-requests
content-type: text/html; charset=UTF-8
date: Thu, 15 Dec 2022 14:15:07 GMT
server: nginx
strict-transport-security: max-age=31536000

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: away.cdnbestplatform.com
URL: https://away.cdnbestplatform.com/go.php?id=3245467-34-56736-11

Domain: greenskymotions.net
URL: https://greenskymotions.net/go/mu4genjugq5dcmjrhe3a?sub2=dfastspeed14

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.greenskymotions.net/	1970-01-20 08:55:05	Name: uuid Value: bd9d7d07-c028-4f3b-9afa-b88764119fff
.0.greenskymotions.net/	1970-01-20 08:55:05	Name: uuid Value: bd9d7d07-c028-4f3b-9afa-b88764119fff
di4.biz/	1970-01-20 08:55:05	Name: uuid Value: 657d2522-49f5-436f-b20b-a797eef81818

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0.greenskymotions.net
away.cdnbestplatform.com
di4.biz
greenskymotions.net
kersoninvestments.com
new.weatherplllatform.com
away.cdnbestplatform.com
greenskymotions.net
109.234.164.89
185.177.92.179
185.177.94.152
91.211.91.104
91.211.91.114
42c769853ecc4db7a7b8829904c83c4fa1585591dce029c437af88dea06957b9
9254142ec66d2ce1d2f2b3a632b952e58dd587308ce99a7557f54380c5529457
a5308b7decd6fc2d5e8438fb037c4a822125135db832c05437d754655ff2fc23
af8b20e40e19ff4a8c23e6d714c04934c802e83dd397f79795aa5a3b684f8b7f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ed9e4bd723e8b906c9b2d3b20aaaa7700c5c78fb850539af3080fed7fb187eb1

0.greenskymotions.net Open in urlscan Pro 185.177.94.152 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

8 Requests

63 %HTTPS

0 %IPv6

5 Domains

6 Subdomains

6 IPs

3 Countries

32 kBTransfer

33 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

3 Cookies

Indicators

0.greenskymotions.net Open in urlscan Pro
185.177.94.152 Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

63 %
HTTPS

0 %
IPv6

5
Domains

6
Subdomains

6
IPs

3
Countries

32 kB
Transfer

33 kB
Size

3
Cookies

8 HTTP transactions
1 data transactions