covidrtw.online - urlscan.io

Summary

This website contacted 5 IPs in 3 countries across 5 domains to perform 7 HTTP transactions. The main IP is 95.217.117.42, located in Helsinki, Finland and belongs to HETZNER-AS, DE. The main domain is covidrtw.online.

This is the only time covidrtw.online was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	95.217.117.42 95.217.117.42	24940 (HETZNER-AS) (HETZNER-AS)
2	2606:4700::68... 2606:4700::6810:135e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2001:4de0:ac1... 2001:4de0:ac18::1:a:3a	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2606:4700:303... 2606:4700:3030::ac43:da20	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	5

1 95.217.117.42 (Helsinki, Finland)

ASN24940 (HETZNER-AS, DE)
PTR: 95-217-117-42.serverhub.ru

covidrtw.online	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:135e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4de0:ac18::1:a:3a (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3030::ac43:da20 (United States)

ASN13335 (CLOUDFLARENET, US)

mykeit3.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	jquery.com code.jquery.com	108 KB
2	cloudflare.com cdnjs.cloudflare.com	10 KB
1	mykeit3.info mykeit3.info	1 KB
1	covidrtw.online covidrtw.online	4 KB
0	yourbigger-topprizes.life Failed yourbigger-topprizes.life Failed
7	5

	Domain	Requested by
2	code.jquery.com	covidrtw.online
2	cdnjs.cloudflare.com	covidrtw.online
1	mykeit3.info	covidrtw.online
1	covidrtw.online
0	yourbigger-topprizes.life Failed	mykeit3.info
7	5

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-10-21` - `2021-10-20`	a year	crt.sh
jquery.org Sectigo RSA Domain Validation Secure Server CA	`2020-10-06` - `2021-10-16`	a year	crt.sh

This page contains 1 frames:

Frame: https://yourbigger-topprizes.life/?u=60ekae3&o=unfh21n&t=JP_over
Frame ID: 30E84726F26C7AFDF52B7FADFAC2FC0B
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

7
Requests

71 %
HTTPS

75 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

123 kB
Transfer

427 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
covidrtw.online/ 11 KB
4 KB 90ms
63ms Document
text/html 95.217.117.42
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://covidrtw.online/
Protocol: HTTP/1.1
Server: 95.217.117.42 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: 95-217-117-42.serverhub.ru
Software: nginx/1.10.3 /
Resource Hash: 903a8f49322dfc3265ba70ab0c1203c8444e7f0af38f9eb83fc6a2b056122cb1

Request headers

Host: covidrtw.online
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Server: nginx/1.10.3
Date: Thu, 27 May 2021 06:48:24 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip

GET
H2 200 bttn.min.css
cdnjs.cloudflare.com/ajax/libs/bttn.css/0.2.4/ 32 KB
4 KB 26ms
26ms Stylesheet
text/css 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/bttn.css/0.2.4/bttn.min.css

Requested by

Host: covidrtw.online
URL: http://covidrtw.online/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

35c313f00ec245de0d68fea44789d39e28e0d9663225d67a17c4e0fe12fc1b1c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: http://covidrtw.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 27 May 2021 06:48:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 2920735
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3265
cf-request-id: 0a4e2de8ab00004aa3308e8000000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:09:01 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e1d-8194"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=Ii4Sy8yPh4ykO9hP5Z7l28FBNFEtxm9BN5Z%2BWjFB1OBmuU8m4Tg%2FJvtmC7j1f4KHkMl6%2F7qy623r3A39Oln9ksjDK87aDErx1vwfsDKdhtT5GXqhBI6kfD%2BqA9yyCA2q0QXGY1khhLLC7qSFFQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 655d4c211e564aa3-FRA
expires: Tue, 17 May 2022 06:48:24 GMT

GET
H2 200 shoelace.css
cdnjs.cloudflare.com/ajax/libs/shoelace-css/1.0.0-beta9/ 35 KB
6 KB 21ms
21ms Stylesheet
text/css 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/shoelace-css/1.0.0-beta9/shoelace.css

Requested by

Host: covidrtw.online
URL: http://covidrtw.online/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2857f8aa694b915ca417348891fc1595609be3f3eea767dacfaf5983c552c5a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: http://covidrtw.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 27 May 2021 06:48:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 630078
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 6159
cf-request-id: 0a4e2de8ac00004aa3381c7000000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:16:14 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03fce-8d12"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=9UG%2F6eDEPVLMzI7qonb45TxfXCpfDB%2F8TLUhSDsolIlUL7sNMlCjPG4zbxWzlqpDx8WcdmLoo%2BvweDCWmTgzpLLD7lqKvMmOsgQe0NFU4e%2FzyXY1J5aisTBm4VZWJDVx6vhSVi%2FGUXCfdHmu4A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 655d4c211e574aa3-FRA
expires: Tue, 17 May 2022 06:48:24 GMT

GET
H2 200 jquery-2.2.4.min.js Show response
code.jquery.com/ 84 KB
29 KB 9ms
9ms Script
application/javascript 2001:4de0:ac18::1:a:3a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-2.2.4.min.js
Requested by: Host: covidrtw.online
URL: http://covidrtw.online/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:3a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Request headers

Referer: http://covidrtw.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 27 May 2021 06:48:24 GMT
content-encoding: gzip
last-modified: Fri, 20 May 2016 17:24:41 GMT
server: nginx
etag: W/"573f4859-14e4a"
vary: Accept-Encoding
x-hw: 1622098104.dop227.fr8.t,1622098104.cds233.fr8.hn,1622098104.cds130.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 29811

GET
H2 200 jquery-3.3.1.js Show response
code.jquery.com/ 265 KB
79 KB 10ms
9ms Script
application/javascript 2001:4de0:ac18::1:a:3a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.3.1.js
Requested by: Host: covidrtw.online
URL: http://covidrtw.online/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:3a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: d8aa24ecc6cecb1a60515bc093f1c9da38a0392612d9ab8ae0f7f36e6eee1fad

Request headers

Referer: http://covidrtw.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 27 May 2021 06:48:24 GMT
content-encoding: gzip
last-modified: Sat, 20 Jan 2018 17:26:44 GMT
server: nginx
etag: W/"5a637bd4-42587"
vary: Accept-Encoding
x-hw: 1622098104.dop227.fr8.t,1622098104.cds233.fr8.hn,1622098104.cds165.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 80268

GET
H2 200 BMDNZX
mykeit3.info/ 206 B
1 KB 138ms
106ms Script
application/javascript 2606:4700:3030::ac43:da20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mykeit3.info/BMDNZX?keyword=Nike%20Cortez%20Kendrick%20Lamar%20Slip%202021
Requested by: Host: covidrtw.online
URL: http://covidrtw.online/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::ac43:da20 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: http://covidrtw.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 27 May 2021 06:48:24 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","max_age":604800}
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 0a4e2de8f700004a5b3c0cd000000001
pragma: no-cache
last-modified: Thu, 27 May 2021 06:48:24 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=yNRr3S2TVrEZBUmrKRhh3vDQP9BiLDAcakQOxSxa56qCLOiIVKCgoFvq1E9NFj2Y87FvM5XGmZgE26I65phJJVz7nqHUM40kMZYe%2BfbMARh5F7oecMq1m68yb77VGIZBTG61kVMu"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate,post-check=0,pre-check=0
cf-ray: 655d4c21883d4a5b-FRA
expires: 0

GET /
yourbigger-topprizes.life/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: yourbigger-topprizes.life
URL: https://yourbigger-topprizes.life/?u=60ekae3&o=unfh21n&t=JP_over

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
code.jquery.com
covidrtw.online
mykeit3.info
yourbigger-topprizes.life
yourbigger-topprizes.life
2001:4de0:ac18::1:a:3a
2606:4700:3030::ac43:da20
2606:4700::6810:135e
95.217.117.42
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
2857f8aa694b915ca417348891fc1595609be3f3eea767dacfaf5983c552c5a9
35c313f00ec245de0d68fea44789d39e28e0d9663225d67a17c4e0fe12fc1b1c
903a8f49322dfc3265ba70ab0c1203c8444e7f0af38f9eb83fc6a2b056122cb1
d8aa24ecc6cecb1a60515bc093f1c9da38a0392612d9ab8ae0f7f36e6eee1fad

covidrtw.online Open in urlscan Pro 95.217.117.42 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

7 Requests

71 %HTTPS

75 %IPv6

5 Domains

5 Subdomains

5 IPs

3 Countries

123 kBTransfer

427 kBSize

0 Cookies

0 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

0 Cookies

Indicators

covidrtw.online Open in urlscan Pro
95.217.117.42 Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

71 %
HTTPS

75 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

123 kB
Transfer

427 kB
Size

0
Cookies

7 HTTP transactions
0 data transactions