urlscan.io logo urlscan.io
SecurityTrails logo

www.whatszip.ru Open in urlscan Pro
31.31.196.33  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://www.whatszip.ru/
Effective URL: https://www.whatszip.ru/login
Submission Tags: @phish_report
Submission: On May 10 via api from FI — Scanned from AU
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 6 HTTP transactions. The main IP is 31.31.196.33, located in Russian Federation and belongs to AS-REG, RU. The main domain is www.whatszip.ru.
TLS certificate: Issued by whatszip.ru on May 9th 2024. Valid for: a year.
This is the only time www.whatszip.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 4 31.31.196.33 197695 (AS-REG)
1 103.180.114.1 200325 (BUNNYCDN)
6 3
Apex Domain
Subdomains		 Transfer
4 whatszip.ru
www.whatszip.ru
10 KB
1 bunny.net
fonts.bunny.net — Cisco Umbrella Rank: 10256
1 KB
0 Failed
function sub() { [native code] }. Failed
6 3
Domain Requested by
4 www.whatszip.ru 2 redirects
1 fonts.bunny.net www.whatszip.ru
0 ::1 Failed www.whatszip.ru
6 3

This site contains no links.

Subject Issuer Validity Valid
whatszip.ru
whatszip.ru		 2024-05-09 -
2025-05-08		 a year crt.sh
fonts.bunny.net
R3		 2024-04-09 -
2024-07-08		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://www.whatszip.ru/login
Frame ID: E98B1F39CF11473BDFB540B1C536FCE6
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

WhatsZip

Page URL History Show full URLs

  1. http://www.whatszip.ru/ HTTP 307
    https://www.whatszip.ru/ HTTP 302
    https://www.whatszip.ru/dashboard HTTP 302
    https://www.whatszip.ru/login Page URL

Page Statistics

6
Requests

17 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

9 kB
Transfer

23 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://www.whatszip.ru/ HTTP 307
    https://www.whatszip.ru/ HTTP 302
    https://www.whatszip.ru/dashboard HTTP 302
    https://www.whatszip.ru/login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request login
www.whatszip.ru/
Redirect Chain
  • http://www.whatszip.ru/
  • https://www.whatszip.ru/
  • https://www.whatszip.ru/dashboard
  • https://www.whatszip.ru/login
20 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.whatszip.ru/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
31.31.196.33 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
server32.hosting.reg.ru
Software
nginx / PHP/8.2.15
Resource Hash
ad278bc3c3e1a468e2c9115b39395bec77b9f7b94ecdb85b8e2c053554fd65cf

Request headers

Accept-Language
en-AU,en;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

cache-control
private, must-revalidate
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Fri, 10 May 2024 18:33:38 GMT
expires
-1
pragma
no-cache
server
nginx
vary
Accept-Encoding X-Inertia,Origin
x-powered-by
PHP/8.2.15

Redirect headers

cache-control
private, must-revalidate
content-type
text/html; charset=utf-8
date
Fri, 10 May 2024 18:33:37 GMT
expires
-1
location
https://www.whatszip.ru/login
pragma
no-cache
server
nginx
vary
Origin
x-powered-by
PHP/8.2.15
css
fonts.bunny.net/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.bunny.net/css?family=figtree:400,500,600&display=swap
Requested by
Host: www.whatszip.ru
URL: https://www.whatszip.ru/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.180.114.1 , Australia, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-SYD1-1151 /
Resource Hash
3494bbb490c1d6bbb3cc180aaae84ac685380df5b995b6318afc48c232a7da1f

Request headers

Accept-Language
en-AU,en;q=0.9;q=0.9
Referer
https://www.whatszip.ru/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date
Fri, 10 May 2024 18:33:38 GMT
content-encoding
br
cdn-edgestorageid
1151
cdn-cachedat
05/09/2024 12:37:05
cdn-pullzone
781720
last-modified
Thu, 09 May 2024 12:37:05 GMT
server
BunnyCDN-SYD1-1151
cdn-proxyver
1.04
cdn-requestpullcode
200
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
3a60ca70-b89d-4cd5-a4b5-34a3468d7e0f
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=2592000
cdn-requestid
aca98d20313e95fb7c944bfb9cde94cd
cdn-requestcountrycode
AU
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
cdn-requestpullsuccess
True
client
[::1]/@vite/ 		0
0
app.js
[::1]/resources/js/ 		0
0
Login.vue
[::1]/resources/js/Pages/Auth/ 		0
0
favicon.ico
www.whatszip.ru/ 		0
132 B 		Other
General
Check archive.org
Download Go to
Full URL
https://www.whatszip.ru/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
31.31.196.33 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
server32.hosting.reg.ru
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-AU,en;q=0.9;q=0.9
Referer
https://www.whatszip.ru/login
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date
Fri, 10 May 2024 18:33:38 GMT
last-modified
Fri, 10 May 2024 17:55:22 GMT
server
nginx
accept-ranges
bytes
etag
"0-6181d3d5d8e5a"
content-length
0
content-type
image/vnd.microsoft.icon

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
::1
URL
http://[::1]:5173/@vite/client
Domain
::1
URL
http://[::1]:5173/resources/js/app.js
Domain
::1
URL
http://[::1]:5173/resources/js/Pages/Auth/Login.vue

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| route

2 Cookies

Domain/Path Name / Value
www.whatszip.ru/ Name: XSRF-TOKEN
Value: eyJpdiI6IkMyK2ppenBVQ05vZVgrN3pSK2ZzYkE9PSIsInZhbHVlIjoiV0tncHh0dktBRDRUaVB4dTdkdjE5QThMR0RheUQxVTZ0RGVrSzgrZlUrZU1SRHVaOVE0UFVYWC8wRE1VWVREZmIxdTRvUzJzVmxNNEhab051N1JIL25tbDU3d2o4UHp0ZnordW10WEpCQjIwZS9xTThiamVOaXUvcHpGa3FNdCsiLCJtYWMiOiI3OGQ4YTQwN2ZjZWQ0N2QzMDllNDU3NzY5ZjYxZDc3YzQ2ZDMxN2FhOTI1YzY0ZGVkZTJjZmQyNDg1ZDQzNGNhIiwidGFnIjoiIn0%3D
www.whatszip.ru/ Name: whatszip_session
Value: eyJpdiI6ImdSWTM3NkVzZmxodFpoQkZTTk5uTnc9PSIsInZhbHVlIjoiNCtrUy80cWZ4bTVOZ3lMcGNkUW9jRnFFRVV5N2ZVZXBqaXZKZnhISmszV0tZT2VHY3pwSDJWUVB5Z3RKQ2xTYXVlRy9YSjNoTHhDaGZLUUxrSjlpREliYnU3eDB6WjdyaEhnRDQrM28wZUgxOFJYQUFpK2Z2ZFdGNzlpYW50MEYiLCJtYWMiOiI1OTcxMjgyNDYyM2Q2ZGFhZjIxYWMxZmE3M2ZkMjM5YWExMjdkNTg3MTdmZWYxYzA0NmY3ZDlhYWQ1NzEyNGViIiwidGFnIjoiIn0%3D

3 Console Messages

Source Level URL
Text
network error URL: http://[::1]:5173/@vite/client
Message:
Failed to load resource: net::ERR_CONNECTION_REFUSED
network error URL: http://[::1]:5173/resources/js/app.js
Message:
Failed to load resource: net::ERR_CONNECTION_REFUSED
network error URL: http://[::1]:5173/resources/js/Pages/Auth/Login.vue
Message:
Failed to load resource: net::ERR_CONNECTION_REFUSED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

::1
fonts.bunny.net
www.whatszip.ru
::1
103.180.114.1
31.31.196.33
3494bbb490c1d6bbb3cc180aaae84ac685380df5b995b6318afc48c232a7da1f
ad278bc3c3e1a468e2c9115b39395bec77b9f7b94ecdb85b8e2c053554fd65cf
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855