safeentry.wtf Open in urlscan Pro
2a00:8620:201:434::d9c5 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://safeentry.wtf/
Submission: On July 14 via automatic, source certstream-suspicious (July 14th 2020, 8:30:18 am UTC)

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 11 HTTP transactions. The main IP is 2a00:8620:201:434::d9c5, located in Bosnia & Herzegovina and belongs to GLOBALHOST-BOSNIA-AS, BA. The main domain is safeentry.wtf.
TLS certificate: Issued by Let's Encrypt Authority X3 on July 14th 2020. Valid for: 3 months.

This is the only time safeentry.wtf was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
6	2a00:8620:201... 2a00:8620:201:434::d9c5	200698 (GLOBALHOS...) (GLOBALHOST-BOSNIA-AS)
1	2a04:4e42:1b:... 2a04:4e42:1b::621	54113 (FASTLY) (FASTLY)
11	3

6 2a00:8620:201:434::d9c5 (Bosnia & Herzegovina)

ASN200698 (GLOBALHOST-BOSNIA-AS, BA)

safeentry.wtf	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:1b::621 (Ascension Island)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	safeentry.wtf safeentry.wtf	1 MB
1	jsdelivr.net cdn.jsdelivr.net	2 KB
0	Failed function sub() { [native code] }. Failed
11	3

	Domain	Requested by
6	safeentry.wtf	safeentry.wtf cdn.jsdelivr.net
1	cdn.jsdelivr.net	safeentry.wtf
0	localhost Failed
11	3

This site contains no links.

Subject Issuer	Validity	Valid
safeentry.wtf Let's Encrypt Authority X3	`2020-07-14` - `2020-10-12`	3 months	crt.sh
f3.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2020-07-08` - `2021-04-17`	9 months	crt.sh

This page contains 1 frames:

Primary Page: https://safeentry.wtf/
Frame ID: EEE15E302E38B8B1355C347846504F6C
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Debian (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Debian/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

11
Requests

64 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

1148 kB
Transfer

7341 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
safeentry.wtf/ 3 KB
2 KB 217ms
61ms Document
text/html 2a00:8620:201:434::d9c5
GLOBALHOST-BOSNIA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://safeentry.wtf/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a00:8620:201:434::d9c5 , Bosnia & Herzegovina, ASN200698 (GLOBALHOST-BOSNIA-AS, BA),
Reverse DNS
Software: Apache/2.4.38 (Debian) / Express
Resource Hash: 9708db300a22af6fa155885a602e6ef7757d0a8324e9bb70d85dbc737a7601a8

Request headers

Host: safeentry.wtf
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 14 Jul 2020 08:30:01 GMT
Server: Apache/2.4.38 (Debian)
X-Powered-By: Express
Accept-Ranges: bytes
Content-Type: text/html; charset=UTF-8
ETag: W/"d67-tfmDbp5FsjAPYal8E1PQebRpM6U-gzip"
Vary: Accept-Encoding
Content-Encoding: gzip
Access-Control-Allow-Origin: *
Content-Length: 1510
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive

GET
H/1.1 200
OK decoder.js Show response
safeentry.wtf/ 3 MB
520 KB 82ms
82ms Script
application/javascript 2a00:8620:201:434::d9c5
GLOBALHOST-BOSNIA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://safeentry.wtf/decoder.js
Requested by: Host: safeentry.wtf
URL: https://safeentry.wtf/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a00:8620:201:434::d9c5 , Bosnia & Herzegovina, ASN200698 (GLOBALHOST-BOSNIA-AS, BA),
Reverse DNS
Software: Apache/2.4.38 (Debian) / Express
Resource Hash: 63b2c454e202c787fd8fca380be925a0c40870cfc7786a65eabd979d74e24ff7

Request headers

Referer: https://safeentry.wtf/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 14 Jul 2020 08:30:01 GMT
Content-Encoding: gzip
ETag: W/"36072d-sz469OoOSUqnVHtdEhP3n7f1TEk-gzip"
Server: Apache/2.4.38 (Debian)
X-Powered-By: Express
Vary: Accept-Encoding
Content-Type: application/javascript; charset=UTF-8
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99

GET
H/1.1 200
OK styles.css
safeentry.wtf/ 5 KB
2 KB 446ms
60ms Stylesheet
text/css 2a00:8620:201:434::d9c5
GLOBALHOST-BOSNIA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://safeentry.wtf/styles.css
Requested by: Host: safeentry.wtf
URL: https://safeentry.wtf/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a00:8620:201:434::d9c5 , Bosnia & Herzegovina, ASN200698 (GLOBALHOST-BOSNIA-AS, BA),
Reverse DNS
Software: Apache/2.4.38 (Debian) / Express
Resource Hash: eb7d54b8fcacc43a3a3d2ac8cc423a01d9d098f72560e90f2319e3c2ffc79e23

Request headers

Referer: https://safeentry.wtf/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 14 Jul 2020 08:30:02 GMT
Content-Encoding: gzip
ETag: W/"1519-p2fWKIOOw5fHIiY/8itKWDsCGxs-gzip"
Server: Apache/2.4.38 (Debian)
X-Powered-By: Express
Vary: Accept-Encoding
Content-Type: text/css; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 1759

GET
H2 200 pwacompat.min.js Show response
cdn.jsdelivr.net/npm/pwacompat@2.0.6/ 4 KB
2 KB 8ms
8ms Script
application/javascript 2a04:4e42:1b::621
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/pwacompat@2.0.6/pwacompat.min.js

Requested by

Host: safeentry.wtf
URL: https://safeentry.wtf/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::621 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

c921d0c9d72eddc230a807d9ec24bb0ca1c34bf9b16a8145c2135bda2c9b3bb7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://safeentry.wtf/
Origin: https://safeentry.wtf

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 4386816
x-cache: HIT, HIT
status: 200
content-length: 2138
etag: W/"11aa-TBTu4MOac5ffp326dKgmFiK2WUU"
x-served-by: cache-fra19166-FRA, cache-hhn4029-HHN
date: Tue, 14 Jul 2020 08:30:02 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H/1.1 200
OK main.55a7e8b0a1276a45bbd6.bundle.js Show response
safeentry.wtf/ 409 KB
102 KB 516ms
69ms Script
application/javascript 2a00:8620:201:434::d9c5
GLOBALHOST-BOSNIA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://safeentry.wtf/main.55a7e8b0a1276a45bbd6.bundle.js
Requested by: Host: safeentry.wtf
URL: https://safeentry.wtf/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a00:8620:201:434::d9c5 , Bosnia & Herzegovina, ASN200698 (GLOBALHOST-BOSNIA-AS, BA),
Reverse DNS
Software: Apache/2.4.38 (Debian) / Express
Resource Hash: b5668139ca3cf6a47df7d63d131174495f3b98fbaddf49a39b58272c45cf4f8d

Request headers

Referer: https://safeentry.wtf/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 14 Jul 2020 08:30:02 GMT
Content-Encoding: gzip
ETag: W/"665e2-O7FUHWsFIkH1gWDFdmT88tEPY2M-gzip"
Server: Apache/2.4.38 (Debian)
X-Powered-By: Express
Vary: Accept-Encoding
Content-Type: application/javascript; charset=UTF-8
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 715 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK manifest.json Show response
safeentry.wtf/ 521 B
852 B 61ms
60ms Fetch
application/json 2a00:8620:201:434::d9c5
GLOBALHOST-BOSNIA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://safeentry.wtf/manifest.json
Requested by: Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/pwacompat@2.0.6/pwacompat.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a00:8620:201:434::d9c5 , Bosnia & Herzegovina, ASN200698 (GLOBALHOST-BOSNIA-AS, BA),
Reverse DNS
Software: Apache/2.4.38 (Debian) / Express
Resource Hash: 4120f4842946c09199418fa9ad5824d0e0a637a2b76835e88ad9bae80ce0e433

Request headers

Referer: https://safeentry.wtf/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 14 Jul 2020 08:30:02 GMT
ETag: W/"209-ZiSsVYtZWYolLhVtBZoqMzalG+o"
Server: Apache/2.4.38 (Debian)
X-Powered-By: Express
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96
Content-Length: 521

GET
H/1.1 200
OK decoder.js
safeentry.wtf/ 3 MB
520 KB 140ms
79ms Other
application/javascript 2a00:8620:201:434::d9c5
GLOBALHOST-BOSNIA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://safeentry.wtf/decoder.js
Requested by: Host:
URL: webpack:///./app/js/vendor/qrscan.js?
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a00:8620:201:434::d9c5 , Bosnia & Herzegovina, ASN200698 (GLOBALHOST-BOSNIA-AS, BA),
Reverse DNS
Software: Apache/2.4.38 (Debian) / Express
Resource Hash: 63b2c454e202c787fd8fca380be925a0c40870cfc7786a65eabd979d74e24ff7

Request headers

Referer: https://safeentry.wtf/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 14 Jul 2020 08:30:02 GMT
Content-Encoding: gzip
ETag: W/"36072d-sz469OoOSUqnVHtdEhP3n7f1TEk-gzip"
Server: Apache/2.4.38 (Debian)
X-Powered-By: Express
Vary: Accept-Encoding
Content-Type: application/javascript; charset=UTF-8
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=95

GET info
localhost/sockjs-node/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: localhost
URL: https://localhost:8080/sockjs-node/info?t=1594715403145

Domain: localhost
URL: https://localhost:8080/sockjs-node/info?t=1594715404236

Domain: localhost
URL: https://localhost:8080/sockjs-node/info?t=1594715406317

Domain: localhost
URL: https://localhost:8080/sockjs-node/info?t=1594715410366

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: webpack:///(webpack)/hot/log.js?(Line 24) Message: [HMR] Waiting for update signal from WDS...
console-api	error	URL: webpack:///(webpack)-dev-server/client?(Line 172) Message: [WDS] Disconnected!
console-api	log	URL: webpack:///./app/js/vendor/qrscan.js?(Line 70) Message: Error occurred [object DOMException]
console-api	log	URL: webpack:///./app/js/main.js?(Line 20) Message: SW registered: [object ServiceWorkerRegistration]

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
localhost
safeentry.wtf
localhost
2a00:8620:201:434::d9c5
2a04:4e42:1b::621
4120f4842946c09199418fa9ad5824d0e0a637a2b76835e88ad9bae80ce0e433
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd
63b2c454e202c787fd8fca380be925a0c40870cfc7786a65eabd979d74e24ff7
9708db300a22af6fa155885a602e6ef7757d0a8324e9bb70d85dbc737a7601a8
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627
b5668139ca3cf6a47df7d63d131174495f3b98fbaddf49a39b58272c45cf4f8d
c921d0c9d72eddc230a807d9ec24bb0ca1c34bf9b16a8145c2135bda2c9b3bb7
eb7d54b8fcacc43a3a3d2ac8cc423a01d9d098f72560e90f2319e3c2ffc79e23

safeentry.wtf Open in urlscan Pro 2a00:8620:201:434::d9c5 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

11 Requests

64 %HTTPS

100 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

1148 kBTransfer

7341 kBSize

0 Cookies

0 Outgoing links

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

0 Cookies

4 Console Messages

Indicators

safeentry.wtf Open in urlscan Pro
2a00:8620:201:434::d9c5 Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

64 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

1148 kB
Transfer

7341 kB
Size

0
Cookies

11 HTTP transactions
2 data transactions