www.labqus.net - urlscan.io

Summary

This website contacted 5 IPs in 5 countries across 5 domains to perform 5 HTTP transactions. The main IP is 89.46.109.35, located in Arezzo, Italy and belongs to ARUBA-ASN, IT. The main domain is www.labqus.net.

This is the only time www.labqus.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 2	89.46.109.35 89.46.109.35	31034 (ARUBA-ASN) (ARUBA-ASN)
1	213.142.150.131 213.142.150.131	207633 (NOSSPEED) (NOSSPEED)
1	31.3.2.72 31.3.2.72	21245 (MEDIANOVA...) (MEDIANOVA-CDN)
1	172.67.146.250 172.67.146.250	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	41.71.104.171 41.71.104.171	37053 (RSAWEB-AS) (RSAWEB-AS)
5	5

2 89.46.109.35 (Arezzo, Italy) 1 redirects

ASN31034 (ARUBA-ASN, IT)
PTR: webx1364.aruba.it

labqus.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.labqus.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 213.142.150.131 (Turkey)

ASN207633 (NOSSPEED, TR)
PTR: host.bogahost.com

m5dergi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 31.3.2.72 (Frankfurt am Main, Germany)

ASN21245 (MEDIANOVA-CDN, TR)

img.piri.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.146.250 (United States)

ASN13335 (CLOUDFLARENET, US)

i.hizliresim.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 41.71.104.171 (Cape Town, South Africa)

ASN37053 (RSAWEB-AS, ZA)
PTR: cps04.webhosting.rsaweb.net

jabeztelecoms.co.za	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	labqus.net 1 redirects labqus.net www.labqus.net	2 KB
1	jabeztelecoms.co.za jabeztelecoms.co.za
1	hizliresim.com i.hizliresim.com — Cisco Umbrella Rank: 189477	45 KB
1	piri.net img.piri.net — Cisco Umbrella Rank: 483369	163 KB
1	m5dergi.com m5dergi.com	82 KB
5	5

	Domain	Requested by
1	jabeztelecoms.co.za	www.labqus.net
1	i.hizliresim.com	www.labqus.net
1	img.piri.net	www.labqus.net
1	m5dergi.com	www.labqus.net
1	www.labqus.net
1	labqus.net	1 redirects
5	6

This site contains links to these domains. Also see Links.

Domain
shellbasilisiteler.blogspot.com

Subject Issuer	Validity	Valid
m5dergi.com R3	`2023-10-22` - `2024-01-20`	3 months	crt.sh
*.piri.net Sectigo RSA Domain Validation Secure Server CA	`2023-10-10` - `2024-11-04`	a year	crt.sh
hizliresim.com GTS CA 1P5	`2023-09-30` - `2023-12-29`	3 months	crt.sh
*.jabeztelecoms.co.za R3	`2023-09-01` - `2023-11-30`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://www.labqus.net/
Frame ID: AF3B065AF537E3D93954B7B56ACDF05A
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Hacked By ZORKAN

Page URL History Show full URLs

http://labqus.net/ HTTP 301
http://www.labqus.net/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Page Statistics

5
Requests

80 %
HTTPS

0 %
IPv6

5
Domains

6
Subdomains

5
IPs

5
Countries

292 kB
Transfer

1806 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://shellbasilisiteler.blogspot.com/
Title: https://shellbasilisiteler.blogspot.com

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://labqus.net/ HTTP 301
http://www.labqus.net/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response www.labqus.net/ Redirect Chain http://labqus.net/ http://www.labqus.net/	5 KB 2 KB	170ms 88ms	Document text/html	89.46.109.35 ARUBA-ASN
General Check archive.org Show headers Download Go to Full URL http://www.labqus.net/ Protocol HTTP/1.1 Server 89.46.109.35 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT), Reverse DNS webx1364.aruba.it Software aruba-proxy / Resource Hash `208e103fa7f6e72a57351a3580fa37b30ad7fa0a5e86bc5986a2301dc0aa7953` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36 accept-language it-IT,it;q=0.9 Response headers Connection keep-alive Content-Encoding gzip Content-Type text/html Date Thu, 16 Nov 2023 18:46:49 GMT Last-Modified Thu, 16 Nov 2023 16:59:37 GMT Server aruba-proxy Transfer-Encoding chunked Vary Accept-Encoding X-ServerName ipvsproxy182.ad.aruba.it Redirect headers Connection keep-alive Content-Length 168 Content-Type text/html Date Thu, 16 Nov 2023 18:46:49 GMT Location http://www.labqus.net/ Server aruba-proxy X-ServerName ipvsproxy182.ad.aruba.it
GET H2	200	WhatsApp-Image-2020-12-28-at-07.21.28-780x470.jpeg m5dergi.com/wp-content/uploads/2020/12/	81 KB 82 KB	231ms 77ms	Image image/jpeg	213.142.150.131 NOSSPEED
General Check archive.org Show headers Download Go to Show image Full URL https://m5dergi.com/wp-content/uploads/2020/12/WhatsApp-Image-2020-12-28-at-07.21.28-780x470.jpeg Requested by Host: www.labqus.net URL: http://www.labqus.net/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 213.142.150.131 , Turkey, ASN207633 (NOSSPEED, TR), Reverse DNS host.bogahost.com Software Apache / Resource Hash `434806c037399c178d94a93b5176b3f6c91ef4a39b4def62008df5275940f088` Request headers accept-language it-IT,it;q=0.9 Referer http://www.labqus.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36 Response headers date Thu, 16 Nov 2023 18:46:49 GMT last-modified Sun, 20 Feb 2022 13:28:59 GMT server Apache vary Accept-Encoding content-type image/jpeg cache-control max-age=10368000, public accept-ranges bytes content-length 83166 expires Fri, 15 Mar 2024 18:46:49 GMT
GET H2	200	1f5c46afhanzala.jpg img.piri.net/mnresize/900/-/resim/upload/2018/05/23/02/01/	166 KB 163 KB	163ms 48ms	Image image/jpeg	31.3.2.72 MEDIANOVA-CDN
General Check archive.org Show headers Download Go to Show image Full URL https://img.piri.net/mnresize/900/-/resim/upload/2018/05/23/02/01/1f5c46afhanzala.jpg Requested by Host: www.labqus.net URL: http://www.labqus.net/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 31.3.2.72 Frankfurt am Main, Germany, ASN21245 (MEDIANOVA-CDN, TR), Reverse DNS Software MNCDN-236 / Resource Hash `d6833c95938318cbc98b71d81a1067476d61723fba1deb09c48f0aac7087263b` Request headers accept-language it-IT,it;q=0.9 Referer http://www.labqus.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Thu, 16 Nov 2023 18:46:47 GMT content-encoding gzip content-md5 wrdg8SfX+tI5ElJknqcJxw== x-edge-location DE-372 x-cache-status Edge : HIT, x-ms-lease-status unlocked last-modified Wed, 23 May 2018 11:01:12 GMT server MNCDN-236 x-mnrequest-id 7ee3627aeecc84cb6395b126605643bc vary Accept-Encoding content-type image/jpeg access-control-allow-origin * x-ms-request-id 3c4a7dac-a01e-001e-1c4c-fd71cb000000 cache-control max-age=691200 x-ms-version 2009-09-19 x-mserver DE-372 expires Fri, 24 Nov 2023 18:46:47 GMT
GET H2	200	yna7da.gif i.hizliresim.com/	44 KB 45 KB	123ms 41ms	Image image/gif	172.67.146.250 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://i.hizliresim.com/yna7da.gif Requested by Host: www.labqus.net URL: http://www.labqus.net/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.146.250 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `0331c0a9b21c0c09d75fa9011a09795aa5c72f68cc9d3151ec3948d9e56196d5` Request headers accept-language it-IT,it;q=0.9 Referer http://www.labqus.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36 Response headers date Thu, 16 Nov 2023 18:46:49 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-amz-request-id FC6F7CA674688FA4:A age 38 alt-svc h3=":443"; ma=86400 content-length 45284 x-amz-id-2 qz9Lpr/JP64d1ba/4nuEKRJXHKLUfuwStPvxj7wJhN0iKiwfpksxSODTBvqugvNJB5q/b62zLZFp last-modified Fri, 07 Sep 2018 00:34:05 GMT server cloudflare etag "5b17a8315329d294cf423f0876ee5b1e" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6EAqy%2BKlwOwK49Pfrzq4d72TNA0uTHAsFWrZHYEkQZhZsA9KLetMj13hsbVT%2FDd1oVPtpFaye7N25jhYvWr7iDWmTITq8GhmQhQDL28muiHEVYOp4WbiQRNiy6kOUIyHQGlq"}],"group":"cf-nel","max_age":604800} content-type image/gif cache-control max-age=31556926 accept-ranges bytes cf-ray 8271e61f8e57bb29-MXP
GET H/1.1	206 Partial Content	f.mp3 jabeztelecoms.co.za/	1 MB 0	677ms 217ms	Media audio/mpeg	41.71.104.171 RSAWEB-AS
General Check archive.org Show headers Download Go to Full URL https://jabeztelecoms.co.za/f.mp3 Requested by Host: www.labqus.net URL: http://www.labqus.net/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 41.71.104.171 Cape Town, South Africa, ASN37053 (RSAWEB-AS, ZA), Reverse DNS cps04.webhosting.rsaweb.net Software Apache / Resource Hash Request headers Referer http://www.labqus.net/ Accept-Encoding identity;q=1, ;q=0 accept-language* it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36 Range bytes=0- Response headers Date Thu, 16 Nov 2023 18:46:50 GMT Last-Modified Thu, 09 Nov 2023 13:46:35 GMT Server Apache Content-Type audio/mpeg Content-Range bytes 0-4937227/4937228 Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 4937228

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| x function| playAudio

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

i.hizliresim.com
img.piri.net
jabeztelecoms.co.za
labqus.net
m5dergi.com
www.labqus.net
172.67.146.250
213.142.150.131
31.3.2.72
41.71.104.171
89.46.109.35
0331c0a9b21c0c09d75fa9011a09795aa5c72f68cc9d3151ec3948d9e56196d5
208e103fa7f6e72a57351a3580fa37b30ad7fa0a5e86bc5986a2301dc0aa7953
434806c037399c178d94a93b5176b3f6c91ef4a39b4def62008df5275940f088
d6833c95938318cbc98b71d81a1067476d61723fba1deb09c48f0aac7087263b

www.labqus.net Open in urlscan Pro 89.46.109.35 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

5 Requests

80 %HTTPS

0 %IPv6

5 Domains

6 Subdomains

5 IPs

5 Countries

292 kBTransfer

1806 kBSize

0 Cookies

1 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

0 Cookies

Indicators

www.labqus.net Open in urlscan Pro
89.46.109.35 Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

80 %
HTTPS

0 %
IPv6

5
Domains

6
Subdomains

5
IPs

5
Countries

292 kB
Transfer

1806 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions