www.citib.ru Open in urlscan Pro
188.234.238.103 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.citib.ru/
Submission: On July 23 via automatic, source certstream-suspicious (July 23rd 2024, 4:26:45 am UTC) — Scanned from DE

Summary HTTP 11 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 4 IPs in 1 countries across 4 domains to perform 11 HTTP transactions. The main IP is 188.234.238.103, located in Yekaterinburg, Russian Federation and belongs to EKAT-AS, RU. The main domain is www.citib.ru.
TLS certificate: Issued by R3 on April 25th 2024. Valid for: 3 months.

This is the only time www.citib.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
5	188.234.238.103 188.234.238.103	51604 (EKAT-AS) (EKAT-AS)
2	178.248.232.183 178.248.232.183	51115 (HLL-AS) (HLL-AS)
2	213.79.65.56 213.79.65.56	8732 (COMCOR-AS...) (COMCOR-AS Moscow)
11	4

5 188.234.238.103 (Yekaterinburg, Russian Federation)

ASN51604 (EKAT-AS, RU)
PTR: 188x234x238x103.static-business.ekat.ertelecom.ru

www.citib.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.248.232.183 (Russian Federation)

ASN51115 (HLL-AS, RU)

www.drweb.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 213.79.65.56 (Moscow, Russian Federation)

ASN8732 (COMCOR-AS Moscow, RU)

st.drweb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	citib.ru www.citib.ru	258 KB
2	drweb.com st.drweb.com	17 KB
2	drweb.ru www.drweb.ru	22 KB
0	Failed function sub() { [native code] }. Failed
11	4

	Domain	Requested by
5	www.citib.ru	www.citib.ru
2	st.drweb.com	www.drweb.ru
2	www.drweb.ru	www.citib.ru www.drweb.ru
0	zap Failed	www.citib.ru
0	burp Failed	www.citib.ru
11	5

This site contains links to these domains. Also see Links.

Domain
st.drweb.com
download.drweb.ru
products.drweb.ru

Subject Issuer	Validity	Valid
citib.ru R3	`2024-04-25` - `2024-07-24`	3 months	crt.sh
*.drweb.ru GlobalSign GCC R3 DV TLS CA 2020	`2024-01-09` - `2025-02-09`	a year	crt.sh
*.drweb.com GlobalSign GCC R3 DV TLS CA 2020	`2024-01-10` - `2025-02-10`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.citib.ru/
Frame ID: FD40C617F7102350B718D59AC4616198
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

ЦИТИБ - информационная безопасность

Page Statistics

11
Requests

82 %
HTTPS

0 %
IPv6

4
Domains

5
Subdomains

4
IPs

1
Countries

296 kB
Transfer

519 kB
Size

3
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://st.drweb.com/static/new-www/files/Windows_WS_ru.pdf

Search URL Search Domain Scan URL

URL: https://download.drweb.ru/doc/
Title: https://download.drweb.ru/doc

Search URL Search Domain Scan URL

URL: https://products.drweb.ru/enterprise_security_suite/
Title: Dr.Web Enterprise Security Suite

Search URL Search Domain Scan URL

URL: https://products.drweb.ru/enterprise_security_suite/control_center/
Title: Центр управления Dr.Web Enterprise Security Suite

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
www.citib.ru/ 1 KB
2 KB 1176ms
774ms Document
text/html 188.234.238.103
EKAT-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.citib.ru/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

188.234.238.103 Yekaterinburg, Russian Federation, ASN51604 (EKAT-AS, RU),

Reverse DNS

188x234x238x103.static-business.ekat.ertelecom.ru

Software

Resource Hash

ee7cd15798cb8e828760e8db00fa546e23e31dce3f7680179e7be6d8ce454039

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Tue, 23 Jul 2024 04:26:39 GMT
Transfer-Encoding: chunked
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK 646eff4e33357e452cebcce9.js Show response
www.citib.ru/ 175 KB
175 KB 175ms
175ms Script
application/x-javascript 188.234.238.103
EKAT-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.citib.ru/646eff4e33357e452cebcce9.js?1713268946398
Requested by: Host: www.citib.ru
URL: https://www.citib.ru/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 188.234.238.103 Yekaterinburg, Russian Federation, ASN51604 (EKAT-AS, RU),
Reverse DNS: 188x234x238x103.static-business.ekat.ertelecom.ru
Software: /
Resource Hash: 3eb0decd091c8097390d9f786c48703fb1fb6ae897afaad137d8e60e82cec911

Request headers

Referer: https://www.citib.ru/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Tue, 23 Jul 2024 04:26:39 GMT
Last-Modified: Mon, 27 May 2024 07:03:57 GMT
ETag: "6654305d-2bb76"
Content-Type: application/x-javascript
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 179062
Expires: Tue, 30 Jul 2024 04:26:39 GMT

GET
H/1.1 200
okay / Show response
www.drweb.ru/export/mac/ 18 KB
19 KB 424ms
271ms Script
text/javascript 178.248.232.183
HLL-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.drweb.ru/export/mac/?a=descriptions&m=DESCRIPT_WIN_WORK&l=ru&h=2

Requested by

Host: www.citib.ru
URL: https://www.citib.ru/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

178.248.232.183 , Russian Federation, ASN51115 (HLL-AS, RU),

Reverse DNS

Software

QRATOR /

Resource Hash

d9d7c1a2e3d53e26c9dc83cb8a132b8d485d29a3c3bb4eea4648655c1795113c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.citib.ru/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Tue, 23 Jul 2024 04:26:40 GMT
Content-Security-Policy: frame-ancestors 'self'
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer-when-downgrade
Server: QRATOR
X-BESKW: prd1
Transfer-Encoding: chunked
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Connection: keep-alive
Keep-Alive: timeout=15
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
okay / Show response
www.drweb.ru/export/mac/ 2 KB
3 KB 219ms
215ms Script
text/javascript 178.248.232.183
HLL-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.drweb.ru/export/mac/?a=makros&l=ru&m=WIN_WORK_LIC&h=12

Requested by

Host: www.drweb.ru
URL: https://www.drweb.ru/export/mac/?a=descriptions&m=DESCRIPT_WIN_WORK&l=ru&h=2

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

178.248.232.183 , Russian Federation, ASN51115 (HLL-AS, RU),

Reverse DNS

Software

QRATOR /

Resource Hash

7b845033584db29b012dccb9046b6430b71c24afc7448867a2ab5471c15e2a36

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.citib.ru/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date: Tue, 23 Jul 2024 04:26:40 GMT
Content-Security-Policy: frame-ancestors 'self'
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer-when-downgrade
Server: QRATOR
X-BESKW: monique
Transfer-Encoding: chunked
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Connection: keep-alive
Keep-Alive: timeout=15
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK ESS_box_for_descriptions_ru.png
st.drweb.com/static/new-www/box/ 14 KB
14 KB 373ms
152ms Image
image/png 213.79.65.56
COMCOR-AS Moscow

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://st.drweb.com/static/new-www/box/ESS_box_for_descriptions_ru.png?r=1
Requested by: Host: www.drweb.ru
URL: https://www.drweb.ru/export/mac/?a=descriptions&m=DESCRIPT_WIN_WORK&l=ru&h=2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 213.79.65.56 Moscow, Russian Federation, ASN8732 (COMCOR-AS Moscow, RU),
Reverse DNS
Software: nginx/1.14.2 /
Resource Hash: cc40db9b4086406decc20705adf1169a365da530dfecb41ea41728c9e0b15c74

Request headers

Referer: https://www.citib.ru/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Tue, 23 Jul 2024 04:26:40 GMT
Last-Modified: Thu, 08 Oct 2020 09:28:33 GMT
Server: nginx/1.14.2
ETag: "5f7edbc1-3621"
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 13857

GET
H/1.1 200
OK pdf_icon_ru.gif
st.drweb.com/static/new-www/ 3 KB
3 KB 301ms
78ms Image
image/gif 213.79.65.56
COMCOR-AS Moscow

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://st.drweb.com/static/new-www/pdf_icon_ru.gif
Requested by: Host: www.drweb.ru
URL: https://www.drweb.ru/export/mac/?a=descriptions&m=DESCRIPT_WIN_WORK&l=ru&h=2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 213.79.65.56 Moscow, Russian Federation, ASN8732 (COMCOR-AS Moscow, RU),
Reverse DNS
Software: nginx/1.14.2 /
Resource Hash: 2f2a6c813b83d95515218e49979c5aed8d09b257881ac2af2e461646c1161d62

Request headers

Referer: https://www.citib.ru/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Tue, 23 Jul 2024 04:26:40 GMT
Last-Modified: Thu, 08 May 2008 07:50:08 GMT
Server: nginx/1.14.2
ETag: "4822b0b0-aea"
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2794

GET
H/1.1 200
OK e19564320905dc32f5eccd65f996d76c.gif
www.citib.ru/ 35 B
345 B 96ms
96ms Image
image/gif 188.234.238.103
EKAT-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.citib.ru/e19564320905dc32f5eccd65f996d76c.gif
Requested by: Host: www.citib.ru
URL: https://www.citib.ru/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 188.234.238.103 Yekaterinburg, Russian Federation, ASN51604 (EKAT-AS, RU),
Reverse DNS: 188x234x238x103.static-business.ekat.ertelecom.ru
Software: /
Resource Hash: a518a350dd7714768892d4605561245113e1fd647c77e105226f92a88bf5a2d3

Request headers

Referer: https://www.citib.ru/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 23 Jul 2024 04:26:40 GMT
Content-Type: image/gif
Cache-Control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 35
Expires: Tue, 03 Jul 2001 06:00:00 GMT

GET favicon.ico
burp/ 0
0

GET favicon.ico
zap/ 0
0

POST
H/1.1 200
OK beee96cadd53ac1b60e690301887bb76 Show response
www.citib.ru/ 0
154 B 91ms
89ms XHR
text/plain 188.234.238.103
EKAT-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.citib.ru/beee96cadd53ac1b60e690301887bb76
Requested by: Host: www.citib.ru
URL: https://www.citib.ru/646eff4e33357e452cebcce9.js?1713268946398
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 188.234.238.103 Yekaterinburg, Russian Federation, ASN51604 (EKAT-AS, RU),
Reverse DNS: 188x234x238x103.static-business.ekat.ertelecom.ru
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.citib.ru/
X-Requested-With: XMLHttpRequest
X-csrftoken: 17e4bd07f932d0c66859f9bc69e2890998c35ae6aaaeb521c74d16d137b98e999ffcef12abbdf0dd
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: application/octet-stream

Response headers

Date: Tue, 23 Jul 2024 04:26:40 GMT
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: text/plain; charset=utf-8

GET
H/1.1 404
Not Found favicon.ico
www.citib.ru/ 307 KB
81 KB 269ms
238ms Other
text/html 188.234.238.103
EKAT-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.citib.ru/favicon.ico

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

188.234.238.103 Yekaterinburg, Russian Federation, ASN51604 (EKAT-AS, RU),

Reverse DNS

188x234x238x103.static-business.ekat.ertelecom.ru

Software

Resource Hash

eb73ae8e8f5ab0eea8fc8d832646a6a1140cc29e8def4bb9f1e8ba500298d454

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.citib.ru/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Tue, 23 Jul 2024 04:26:40 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
X-Frame-Options: SAMEORIGIN
Content-Type: text/html; charset=utf-8
Connection: keep-alive
X-XSS-Protection: 1; mode=block

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: burp
URL: https://burp/favicon.ico

Domain: zap
URL: https://zap/favicon.ico

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.citib.ru/	1970-01-20 22:16:35	Name: session-cookie Value: 17e4bd07d08a87617507ff50d00b08451321f931e34fe57dbdfc369066435d330654566a5911f04c7aadd76b8c8a1b65
www.citib.ru/	1970-01-20 22:15:09	Name: csrf-token-name Value: csrftoken
www.citib.ru/	1970-01-20 22:15:09	Name: csrf-token-value Value: 17e4bd07f932d0c66859f9bc69e2890998c35ae6aaaeb521c74d16d137b98e999ffcef12abbdf0dd

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://www.drweb.ru/export/mac/?a=descriptions&m=DESCRIPT_WIN_WORK&l=ru&h=2 Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://www.drweb.ru/export/mac/?a=makros&l=ru&m=WIN_WORK_LIC&h=12, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://www.drweb.ru/export/mac/?a=descriptions&m=DESCRIPT_WIN_WORK&l=ru&h=2 Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://www.drweb.ru/export/mac/?a=makros&l=ru&m=WIN_WORK_LIC&h=12, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network	error	URL: https://zap/favicon.ico Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://burp/favicon.ico Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://www.citib.ru/favicon.ico Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

burp
st.drweb.com
www.citib.ru
www.drweb.ru
zap
burp
zap
178.248.232.183
188.234.238.103
213.79.65.56
2f2a6c813b83d95515218e49979c5aed8d09b257881ac2af2e461646c1161d62
3eb0decd091c8097390d9f786c48703fb1fb6ae897afaad137d8e60e82cec911
7b845033584db29b012dccb9046b6430b71c24afc7448867a2ab5471c15e2a36
a518a350dd7714768892d4605561245113e1fd647c77e105226f92a88bf5a2d3
cc40db9b4086406decc20705adf1169a365da530dfecb41ea41728c9e0b15c74
d9d7c1a2e3d53e26c9dc83cb8a132b8d485d29a3c3bb4eea4648655c1795113c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eb73ae8e8f5ab0eea8fc8d832646a6a1140cc29e8def4bb9f1e8ba500298d454
ee7cd15798cb8e828760e8db00fa546e23e31dce3f7680179e7be6d8ce454039

www.citib.ru Open in urlscan Pro 188.234.238.103 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

11 Requests

82 %HTTPS

0 %IPv6

4 Domains

5 Subdomains

4 IPs

1 Countries

296 kBTransfer

519 kBSize

3 Cookies

4 Outgoing links

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

3 Cookies

5 Console Messages

Security Headers

Indicators

www.citib.ru Open in urlscan Pro
188.234.238.103 Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

82 %
HTTPS

0 %
IPv6

4
Domains

5
Subdomains

4
IPs

1
Countries

296 kB
Transfer

519 kB
Size

3
Cookies

11 HTTP transactions
0 data transactions