upndn.16109.aqq.ru - urlscan.io

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 6 HTTP transactions. The main IP is 185.42.12.130, located in Russian Federation and belongs to MULTIHOST-AS, RU. The main domain is upndn.16109.aqq.ru.
TLS certificate: Issued by cPanel, Inc. Certification Authority on November 3rd 2021. Valid for: 3 months.

This is the only time upndn.16109.aqq.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	185.42.12.130 185.42.12.130	56784 (MULTIHOST-AS) (MULTIHOST-AS)
4	93.93.89.17 93.93.89.17	34879 (CCT-AS NG...) (CCT-AS NGENIX)
6	3

2 185.42.12.130 (Russian Federation)

ASN56784 (MULTIHOST-AS, RU)
PTR: s30.multihost.cloud

upndn.16109.aqq.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 93.93.89.17 (Russian Federation)

ASN34879 (CCT-AS NGENIX, RU)
PTR: cdn.ngenix.net

gu-st.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	gu-st.ru gu-st.ru	232 KB
2	aqq.ru upndn.16109.aqq.ru	32 KB
6	2

	Domain	Requested by
4	gu-st.ru	upndn.16109.aqq.ru gu-st.ru
2	upndn.16109.aqq.ru	gu-st.ru
6	2

This site contains links to these domains. Also see Links.

Domain
gosuslugi.ru

Subject Issuer	Validity	Valid
upndn.ru cPanel, Inc. Certification Authority	`2021-11-03` - `2022-02-01`	3 months	crt.sh
gu-st.ru Sectigo RSA Organization Validation Secure Server CA	`2020-06-10` - `2022-09-08`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://upndn.16109.aqq.ru/
Frame ID: 7C80BC5293C3427012BEAB4F62D4CE85
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Портал государственных услуг Российской Федерации

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

264 kB
Transfer

290 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://gosuslugi.ru/
Title: Закрыть

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response upndn.16109.aqq.ru/	31 KB 32 KB	361ms 46ms	Document text/html	185.42.12.130 MULTIHOST-AS
General Check archive.org Show headers Download Go to Full URL https://upndn.16109.aqq.ru/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 185.42.12.130 , Russian Federation, ASN56784 (MULTIHOST-AS, RU), Reverse DNS s30.multihost.cloud Software Apache / Resource Hash `dcb9169e420a0e2cf1a806dbc8827a088b64216482be5d99485b32613cfbf99b` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Date Tue, 16 Nov 2021 12:33:16 GMT Server Apache Last-Modified Thu, 11 Nov 2021 01:48:13 GMT Accept-Ranges bytes Content-Length 32090 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html
GET H2	200	main.css gu-st.ru/covid-web-st/static-pages-assets/covid-cert/	11 KB 4 KB	196ms 46ms	Stylesheet text/css	93.93.89.17 CCT-AS NGENIX
General Check archive.org Show headers Download Go to Full URL https://gu-st.ru/covid-web-st/static-pages-assets/covid-cert/main.css Requested by Host: upndn.16109.aqq.ru URL: https://upndn.16109.aqq.ru/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 93.93.89.17 , Russian Federation, ASN34879 (CCT-AS NGENIX, RU), Reverse DNS cdn.ngenix.net Software nginx / Resource Hash `2082d47107655c83d4ca20779f6cf40cf30c626e14a4810a1fd4080117235997` Request headers Accept-Language de-DE,de;q=0.9 Referer https://upndn.16109.aqq.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Tue, 16 Nov 2021 12:33:16 GMT content-encoding gzip last-modified Sun, 07 Nov 2021 14:20:26 GMT server nginx etag W/"6187e0aa-2bfb" x-ngenix-cache HIT, HIT vary Accept-Encoding, Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	helpers.js Show response gu-st.ru/covid-web-st/static-pages-assets/js/	321 B 492 B	175ms 47ms	Script application/javascript	93.93.89.17 CCT-AS NGENIX
General Check archive.org Show headers Download Go to Full URL https://gu-st.ru/covid-web-st/static-pages-assets/js/helpers.js Requested by Host: upndn.16109.aqq.ru URL: https://upndn.16109.aqq.ru/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 93.93.89.17 , Russian Federation, ASN34879 (CCT-AS NGENIX, RU), Reverse DNS cdn.ngenix.net Software nginx / Resource Hash `dc2fc3c7b9535326afccdbb53dc5199bffbfe1fa14cdcc4c6e6471dc23224a9a` Request headers Accept-Language de-DE,de;q=0.9 Referer https://upndn.16109.aqq.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Tue, 16 Nov 2021 12:33:16 GMT content-encoding gzip last-modified Sun, 07 Nov 2021 14:20:14 GMT server nginx etag W/"6187e09e-141" x-ngenix-cache HIT, HIT vary Accept-Encoding, Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	main.1636323789207.js Show response gu-st.ru/covid-web-st/static-pages-assets/covid-cert/	18 KB 5 KB	175ms 48ms	Script application/javascript	93.93.89.17 CCT-AS NGENIX
General Check archive.org Show headers Download Go to Full URL https://gu-st.ru/covid-web-st/static-pages-assets/covid-cert/main.1636323789207.js Requested by Host: upndn.16109.aqq.ru URL: https://upndn.16109.aqq.ru/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 93.93.89.17 , Russian Federation, ASN34879 (CCT-AS NGENIX, RU), Reverse DNS cdn.ngenix.net Software nginx / Resource Hash `2da7486de6b4b8200c0b24cbe8d895b1460ba40f5502b7c582a74aebd9b28ed1` Request headers Accept-Language de-DE,de;q=0.9 Referer https://upndn.16109.aqq.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Tue, 16 Nov 2021 12:33:16 GMT content-encoding gzip last-modified Sun, 07 Nov 2021 22:42:36 GMT server nginx etag W/"6188565c-48ed" x-ngenix-cache HIT, HIT vary Accept-Encoding, Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET DATA	200 OK	truncated /	5 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `536ed9fb1f1387eb3d20301a6a01c1ae1892fb133b99be8b53ee7923b5d0e244` Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	Lato-Bold.woff2 gu-st.ru/covid-web-st/static-pages-assets/fonts/	223 KB 222 KB	157ms 54ms	Font application/octet-stream	93.93.89.17 CCT-AS NGENIX
General Check archive.org Show headers Download Go to Full URL https://gu-st.ru/covid-web-st/static-pages-assets/fonts/Lato-Bold.woff2 Requested by Host: gu-st.ru URL: https://gu-st.ru/covid-web-st/static-pages-assets/covid-cert/main.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 93.93.89.17 , Russian Federation, ASN34879 (CCT-AS NGENIX, RU), Reverse DNS cdn.ngenix.net Software nginx / Resource Hash `79af3777688e4135969f0ded09a3789f77852392c017150dcaacdaa2227ecccf` Request headers Referer https://gu-st.ru/covid-web-st/static-pages-assets/covid-cert/main.css Origin https://upndn.16109.aqq.ru Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Tue, 16 Nov 2021 12:33:16 GMT content-encoding gzip last-modified Sun, 07 Nov 2021 14:20:14 GMT server nginx etag W/"6187e09e-37d4c" x-ngenix-cache HIT, HIT vary Accept-Encoding, Accept-Encoding content-type application/octet-stream access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	404 Not Found	config.json Show response upndn.16109.aqq.ru/covid-web/	315 B 515 B	43ms 42ms	Fetch text/html	185.42.12.130 MULTIHOST-AS
General Check archive.org Show headers Download Go to Full URL https://upndn.16109.aqq.ru/covid-web/config.json Requested by Host: gu-st.ru URL: https://gu-st.ru/covid-web-st/static-pages-assets/js/helpers.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 185.42.12.130 , Russian Federation, ASN56784 (MULTIHOST-AS, RU), Reverse DNS s30.multihost.cloud Software Apache / Resource Hash `d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3` Request headers Accept-Language de-DE,de;q=0.9 Referer https://upndn.16109.aqq.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Date Tue, 16 Nov 2021 12:33:16 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=99 Content-Length 315 Content-Type text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://upndn.16109.aqq.ru/covid-web/config.json Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

gu-st.ru
upndn.16109.aqq.ru
185.42.12.130
93.93.89.17
2082d47107655c83d4ca20779f6cf40cf30c626e14a4810a1fd4080117235997
2da7486de6b4b8200c0b24cbe8d895b1460ba40f5502b7c582a74aebd9b28ed1
536ed9fb1f1387eb3d20301a6a01c1ae1892fb133b99be8b53ee7923b5d0e244
79af3777688e4135969f0ded09a3789f77852392c017150dcaacdaa2227ecccf
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
dc2fc3c7b9535326afccdbb53dc5199bffbfe1fa14cdcc4c6e6471dc23224a9a
dcb9169e420a0e2cf1a806dbc8827a088b64216482be5d99485b32613cfbf99b

upndn.16109.aqq.ru Open in urlscan Pro 185.42.12.130 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

6 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

1 Countries

264 kBTransfer

290 kBSize

0 Cookies

1 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

upndn.16109.aqq.ru Open in urlscan Pro
185.42.12.130 Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

264 kB
Transfer

290 kB
Size

0
Cookies

6 HTTP transactions
1 data transactions