Submitted URL: https://www.77169.net/go?url=http://nl-3843.ru/258dkax.php
Effective URL: https://nl-3843.ru/258dkax.php
Submission: On August 14 via manual from NL — Scanned from NL

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 3 HTTP transactions. The main IP is 195.133.199.71, located in Tambov, Russian Federation and belongs to RETNNET-AS, RU. The main domain is nl-3843.ru.
TLS certificate: Issued by R3 on August 10th 2023. Valid for: 3 months.
This is the only time nl-3843.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 121.229.14.89 4134 (CHINANET-...)
3 5 195.133.199.71 29470 (RETNNET-AS)
3 2
Apex Domain
Subdomains
Transfer
3 nl-2102.ru
www-kvk.nl-2102.ru
619 B
2 nl-3843.ru
nl-3843.ru
443 B
1 77169.net
www.77169.net
1 KB
3 3
Domain Requested by
3 www-kvk.nl-2102.ru 2 redirects
2 nl-3843.ru 1 redirects
1 www.77169.net
3 3

This site contains no links.

Subject Issuer Validity Valid
www.77169.net
R3
2023-07-21 -
2023-10-19
3 months crt.sh
nl-3843.ru
R3
2023-08-10 -
2023-11-08
3 months crt.sh
www-kvk.nl-2102.ru
R3
2023-08-09 -
2023-11-07
3 months crt.sh

This page contains 1 frames:

Frame: https://www-kvk.nl-2102.ru/gc/
Frame ID: 72C1F450503946DB84EA1E58B64CE3BF
Requests: 3 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://www.77169.net/go?url=http://nl-3843.ru/258dkax.php Page URL
  2. http://nl-3843.ru/258dkax.php HTTP 301
    https://nl-3843.ru/258dkax.php Page URL

Page Statistics

3
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

2 kB
Transfer

4 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.77169.net/go?url=http://nl-3843.ru/258dkax.php Page URL
  2. http://nl-3843.ru/258dkax.php HTTP 301
    https://nl-3843.ru/258dkax.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • https://www-kvk.nl-2102.ru/gc HTTP 301
  • http://www-kvk.nl-2102.ru/gc/ HTTP 301
  • https://www-kvk.nl-2102.ru/gc/

3 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
go
www.77169.net/
4 KB
1 KB
Document
General
Full URL
https://www.77169.net/go?url=http://nl-3843.ru/258dkax.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
121.229.14.89 Suzhou, China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),
Reverse DNS
Software
Apache /
Resource Hash
bb51384ca048e1cabdd9bb62eec9460fd98844e385c156e458d51ade39693734

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

content-encoding
gzip
content-length
950
content-type
text/html; charset=UTF-8
date
Mon, 14 Aug 2023 11:34:13 GMT
server
Apache
vary
Accept-Encoding
Primary Request 258dkax.php
nl-3843.ru/
Redirect Chain
  • http://nl-3843.ru/258dkax.php
  • https://nl-3843.ru/258dkax.php
16 B
234 B
Document
General
Full URL
https://nl-3843.ru/258dkax.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
195.133.199.71 Tambov, Russian Federation, ASN29470 (RETNNET-AS, RU),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash

Request headers

Referer
https://www.77169.net/go?url=http://nl-3843.ru/258dkax.php
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

Connection
keep-alive
Content-Length
16
Content-Type
text/html; charset=UTF-8
Date
Mon, 14 Aug 2023 11:39:48 GMT
Refresh
0; URL=https://www-kvk.nl-2102.ru/gc
Server
nginx/1.18.0 (Ubuntu)

Redirect headers

Connection
close
Content-Length
178
Content-Type
text/html
Date
Mon, 14 Aug 2023 11:39:47 GMT
Location
https://nl-3843.ru/258dkax.php
Server
nginx/1.18.0 (Ubuntu)
/
www-kvk.nl-2102.ru/gc/
Redirect Chain
  • https://www-kvk.nl-2102.ru/gc
  • http://www-kvk.nl-2102.ru/gc/
  • https://www-kvk.nl-2102.ru/gc/
0
177 B
Document
General
Full URL
https://www-kvk.nl-2102.ru/gc/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
195.133.199.71 Tambov, Russian Federation, ASN29470 (RETNNET-AS, RU),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash

Request headers

Referer
https://nl-3843.ru/258dkax.php
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

Connection
keep-alive
Content-Length
0
Content-Type
text/html; charset=UTF-8
Date
Mon, 14 Aug 2023 11:39:50 GMT
Server
nginx/1.18.0 (Ubuntu)

Redirect headers

Connection
close
Content-Length
178
Content-Type
text/html
Date
Mon, 14 Aug 2023 11:39:50 GMT
Location
https://www-kvk.nl-2102.ru/gc/
Server
nginx/1.18.0 (Ubuntu)

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Domain/Path Name / Value
www.77169.net/ Name: wp_xh_session_e41b56f36174d76086ad0e63db577f05
Value: cc444567c3201cb6f5654af70ec077fa%7C%7C1692185653%7C%7C1692182053%7C%7C108cfe94342e4e8ade038349d9db16fb

1 Console Messages

Source Level URL
Text
network error URL: https://www-kvk.nl-2102.ru/gc/
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

nl-3843.ru
www-kvk.nl-2102.ru
www.77169.net
121.229.14.89
195.133.199.71
bb51384ca048e1cabdd9bb62eec9460fd98844e385c156e458d51ade39693734