ipv6.server.katrinagroup.com Open in urlscan Pro
43.229.84.20 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://ipv6.server.katrinagroup.com/
Submission: On April 17 via api (April 17th 2024, 1:42:05 pm UTC) from US — Scanned from SG

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 5 domains to perform 8 HTTP transactions. The main IP is 43.229.84.20, located in Singapore and belongs to EXABYTES-AS-AP Exabytes Network Singapore Pte. Ltd., SG. The main domain is ipv6.server.katrinagroup.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on February 25th 2024. Valid for: 3 months.

This is the only time ipv6.server.katrinagroup.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	43.229.84.20 43.229.84.20	38532 (EXABYTES-...) (EXABYTES-AS-AP Exabytes Network Singapore Pte. Ltd.)
1	195.30.107.31 195.30.107.31	5539 (SPACENET ...) (SPACENET SpaceNET AG)
1	2404:6800:400... 2404:6800:4003:c1a::5f	15169 (GOOGLE) (GOOGLE)
2	52.92.17.200 52.92.17.200	16509 (AMAZON-02) (AMAZON-02)
2	54.203.25.147 54.203.25.147	16509 (AMAZON-02) (AMAZON-02)
8	5

2 43.229.84.20 (Singapore)

ASN38532 (EXABYTES-AS-AP Exabytes Network Singapore Pte. Ltd., SG)
PTR: server.katrinagroup.com

ipv6.server.katrinagroup.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 195.30.107.31 (Germany)

ASN5539 (SPACENET SpaceNET AG, DE)
PTR: cp31.sp-server.net

sys.quandoodrafts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2404:6800:4003:c1a::5f (Singapore, Singapore)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.92.17.200 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-eu-west-1.amazonaws.com

s3-eu-west-1.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.203.25.147 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-203-25-147.us-west-2.compute.amazonaws.com

api.segment.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	segment.io api.segment.io — Cisco Umbrella Rank: 1376	331 B
2	amazonaws.com s3-eu-west-1.amazonaws.com	5 KB
2	katrinagroup.com ipv6.server.katrinagroup.com	2 KB
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 376	33 KB
1	quandoodrafts.com sys.quandoodrafts.com	21 KB
8	5

	Domain	Requested by
2	api.segment.io
2	s3-eu-west-1.amazonaws.com	sys.quandoodrafts.com s3-eu-west-1.amazonaws.com
2	ipv6.server.katrinagroup.com
1	ajax.googleapis.com	sys.quandoodrafts.com
1	sys.quandoodrafts.com	ipv6.server.katrinagroup.com
8	5

This site contains no links.

Subject Issuer	Validity	Valid
book-tomo.katrinagroup.com cPanel, Inc. Certification Authority	`2024-02-25` - `2024-05-25`	3 months	crt.sh
www.sys.quandoodrafts.com R3	`2024-03-20` - `2024-06-18`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
*.s3-eu-west-1.amazonaws.com Amazon RSA 2048 M01	`2024-01-31` - `2025-01-15`	a year	crt.sh
*.segment.io Amazon RSA 2048 M03	`2023-12-13` - `2025-01-11`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://ipv6.server.katrinagroup.com/
Frame ID: 493344859C4781C3E9EFACC1A5030640
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

75 %
HTTPS

20 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

62 kB
Transfer

119 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
ipv6.server.katrinagroup.com/ 932 B
1 KB 71ms
19ms Document
text/html 43.229.84.20
EXABYTES-AS-AP Ex...

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.server.katrinagroup.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 43.229.84.20 , Singapore, ASN38532 (EXABYTES-AS-AP Exabytes Network Singapore Pte. Ltd., SG),
Reverse DNS: server.katrinagroup.com
Software: Apache /
Resource Hash: 4679e3d93daccc525ca34f4f22539f7dcf97dbe98c22c261e545b133fa5a072a

Request headers

Accept-Language: zh-SG,zh;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Accept-Ranges: bytes
Connection: Keep-Alive
Content-Length: 932
Content-Type: text/html
Date: Wed, 17 Apr 2024 13:41:59 GMT
Keep-Alive: timeout=5, max=100
Last-Modified: Thu, 26 Aug 2021 09:15:10 GMT
Server: Apache

GET
H2 200 quandoo-widget-builder.js Show response
sys.quandoodrafts.com/quandoo-widget-builder/ 21 KB
21 KB 687ms
338ms Script
application/javascript 195.30.107.31
SPACENET SpaceNET AG

General

Check archive.org

Show headers Download Go to

Full URL: https://sys.quandoodrafts.com/quandoo-widget-builder/quandoo-widget-builder.js
Requested by: Host: ipv6.server.katrinagroup.com
URL: https://ipv6.server.katrinagroup.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 195.30.107.31 , Germany, ASN5539 (SPACENET SpaceNET AG, DE),
Reverse DNS: cp31.sp-server.net
Software: Apache /
Resource Hash: 1a95123e7d66fa48f97a65fa99acf77121194dd8dcdd2cc3c2c815acfbd711a0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ipv6.server.katrinagroup.com/
Accept-Language: zh-SG,zh;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 17 Apr 2024 13:42:00 GMT
last-modified: Wed, 19 Sep 2018 14:03:14 GMT
server: Apache
accept-ranges: bytes
etag: "48a2e54-555b-57639de15da32"
content-length: 21851
content-type: application/javascript

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.8.3/ 91 KB
33 KB 21ms
4ms Script
text/javascript 2404:6800:4003:c1a::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js

Requested by

Host: sys.quandoodrafts.com
URL: https://sys.quandoodrafts.com/quandoo-widget-builder/quandoo-widget-builder.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4003:c1a::5f Singapore, Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ipv6.server.katrinagroup.com/
Accept-Language: zh-SG,zh;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 04:36:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 551123
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33593
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 11 Apr 2025 04:36:37 GMT

GET
H/1.1 200
OK quandoo-widget-builder.css
s3-eu-west-1.amazonaws.com/quandoo-website/widget-builder/ 3 KB
4 KB 802ms
278ms Stylesheet
text/css 52.92.17.200
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s3-eu-west-1.amazonaws.com/quandoo-website/widget-builder/quandoo-widget-builder.css
Requested by: Host: sys.quandoodrafts.com
URL: https://sys.quandoodrafts.com/quandoo-widget-builder/quandoo-widget-builder.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.92.17.200 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-eu-west-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 0106c677635eff81254c38cf934b24cee6560e53df88cd7511de8b97d0711b74

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ipv6.server.katrinagroup.com/
Accept-Language: zh-SG,zh;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 17 Apr 2024 13:42:02 GMT
Last-Modified: Tue, 06 Sep 2022 08:41:58 GMT
Server: AmazonS3
x-amz-request-id: CV3BT8V1SZ8JX0BT
ETag: "4d22331d416522510f41135bb3eb638c"
x-amz-server-side-encryption: AES256
Content-Type: text/css
Accept-Ranges: bytes
Content-Length: 3441
x-amz-id-2: 4mjaaf8VBK8BrWdITXEsRR0/Mu7UAUgMRo8n7yUSuNW4JEFug4SF61abW0K7LNtnot62rV7GU/Y=

GET
H/1.1 200
OK stylesheet.css
s3-eu-west-1.amazonaws.com/quandoo-website/widget-builder/averta/ 871 B
1 KB 270ms
270ms Stylesheet
text/css 52.92.17.200
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s3-eu-west-1.amazonaws.com/quandoo-website/widget-builder/averta/stylesheet.css
Requested by: Host: s3-eu-west-1.amazonaws.com
URL: https://s3-eu-west-1.amazonaws.com/quandoo-website/widget-builder/quandoo-widget-builder.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.92.17.200 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-eu-west-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 7859b5582600e65163dccbd068df14cffd77f71d91e65ba5d37c646b06f99bec

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://s3-eu-west-1.amazonaws.com/quandoo-website/widget-builder/quandoo-widget-builder.css
Accept-Language: zh-SG,zh;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 17 Apr 2024 13:42:02 GMT
Last-Modified: Tue, 06 Sep 2022 08:41:58 GMT
Server: AmazonS3
x-amz-request-id: CV3DH51V68JJF7MA
ETag: "e4423601b2a8111ff2c43600a8a8b717"
x-amz-server-side-encryption: AES256
Content-Type: text/css
Accept-Ranges: bytes
Content-Length: 871
x-amz-id-2: 61GQrxGK+in2ZK8wbc4EI8fpV+Ycp486Hn4Z6oj/Gik8EsTcPcLfusfBYu4i6B+XVC4pVfycyRs=

GET
H2 200 track
api.segment.io/v1/pixel/ 42 B
166 B 649ms
203ms Image
image/gif 54.203.25.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://api.segment.io/v1/pixel/track?data=eyJ3cml0ZUtleSI6ICI0QWlRQ3huaFA4S2dFVGFuYVRiQ0RSQzRVMTJmbTJJMyIsInVzZXJJZCI6ICJzaW5nbGVfdXNlciIsImV2ZW50IjogIndpZGdldF9waW5ncyIsInByb3BlcnRpZXMiOiB7InR5cGUiOiJtdWx0aS1idXR0b24iLCAibG9jYXRpb24iOiAiaHR0cHM6Ly9pcHY2LnNlcnZlci5rYXRyaW5hZ3JvdXAuY29tLyIsImJjaWQiOiIxNzYxMyIsInBvc2l0aW9uIjoiIiwiYWN0aW9uIjoibG9hZGVkIiwgImRldmljZSI6ImRlc2t0b3AiLCJ2aXNpYmxlIjoidHJ1ZSJ9fQ==

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.203.25.147 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-203-25-147.us-west-2.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ipv6.server.katrinagroup.com/
Accept-Language: zh-SG,zh;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 17 Apr 2024 13:42:02 GMT
cache-control: no-cache, max-age=0
strict-transport-security: max-age=31536000
content-length: 42
content-type: image/gif

GET
H2 200 track
api.segment.io/v1/pixel/ 42 B
165 B 649ms
204ms Image
image/gif 54.203.25.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://api.segment.io/v1/pixel/track?data=eyJ3cml0ZUtleSI6ICI0QWlRQ3huaFA4S2dFVGFuYVRiQ0RSQzRVMTJmbTJJMyIsInVzZXJJZCI6ICJzaW5nbGVfdXNlciIsImV2ZW50IjogIndpZGdldF9waW5ncyIsInByb3BlcnRpZXMiOiB7InR5cGUiOiJtdWx0aS1idXR0b24iLCAibG9jYXRpb24iOiAiaHR0cHM6Ly9pcHY2LnNlcnZlci5rYXRyaW5hZ3JvdXAuY29tLyIsImJjaWQiOiIxNzYxMSIsInBvc2l0aW9uIjoiIiwiYWN0aW9uIjoibG9hZGVkIiwgImRldmljZSI6ImRlc2t0b3AiLCJ2aXNpYmxlIjoidHJ1ZSJ9fQ==

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.203.25.147 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-203-25-147.us-west-2.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ipv6.server.katrinagroup.com/
Accept-Language: zh-SG,zh;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 17 Apr 2024 13:42:02 GMT
cache-control: no-cache, max-age=0
strict-transport-security: max-age=31536000
content-length: 42
content-type: image/gif

GET
H/1.1 500
Internal Server Error favicon.ico
ipv6.server.katrinagroup.com/ 680 B
856 B 19ms
18ms Other
text/html 43.229.84.20
EXABYTES-AS-AP Ex...

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.server.katrinagroup.com/favicon.ico
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 43.229.84.20 , Singapore, ASN38532 (EXABYTES-AS-AP Exabytes Network Singapore Pte. Ltd., SG),
Reverse DNS: server.katrinagroup.com
Software: Apache /
Resource Hash: b2ecd84ec5353a95406c3e53d0e8bb5365a4a33848b9841e099dab2c8212c9d4

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ipv6.server.katrinagroup.com/
Accept-Language: zh-SG,zh;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 17 Apr 2024 13:42:01 GMT
Server: Apache
Connection: close
Content-Length: 680
Content-Type: text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| $ undefined| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://ipv6.server.katrinagroup.com/favicon.ico Message: Failed to load resource: the server responded with a status of 500 (Internal Server Error)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
api.segment.io
ipv6.server.katrinagroup.com
s3-eu-west-1.amazonaws.com
sys.quandoodrafts.com
195.30.107.31
2404:6800:4003:c1a::5f
43.229.84.20
52.92.17.200
54.203.25.147
0106c677635eff81254c38cf934b24cee6560e53df88cd7511de8b97d0711b74
1a95123e7d66fa48f97a65fa99acf77121194dd8dcdd2cc3c2c815acfbd711a0
4679e3d93daccc525ca34f4f22539f7dcf97dbe98c22c261e545b133fa5a072a
61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf
7859b5582600e65163dccbd068df14cffd77f71d91e65ba5d37c646b06f99bec
b2ecd84ec5353a95406c3e53d0e8bb5365a4a33848b9841e099dab2c8212c9d4
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

ipv6.server.katrinagroup.com Open in urlscan Pro 43.229.84.20 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

8 Requests

75 %HTTPS

20 %IPv6

5 Domains

5 Subdomains

5 IPs

3 Countries

62 kBTransfer

119 kBSize

0 Cookies

0 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

ipv6.server.katrinagroup.com Open in urlscan Pro
43.229.84.20 Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

75 %
HTTPS

20 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

62 kB
Transfer

119 kB
Size

0
Cookies

8 HTTP transactions
0 data transactions