hcs2.lv53.com Open in urlscan Pro
192.185.5.194 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://hcs2.lv53.com/
Submission Tags: phishingrod
Submission: On March 23 via api (March 23rd 2024, 2:39:30 pm UTC) from DE — Scanned from DE

Summary HTTP 8 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 7 domains to perform 8 HTTP transactions. The main IP is 192.185.5.194, located in United States and belongs to NETWORK-SOLUTIONS-HOSTING, US. The main domain is hcs2.lv53.com.
TLS certificate: Issued by R3 on January 21st 2024. Valid for: 3 months.

This is the only time hcs2.lv53.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	192.185.5.194 192.185.5.194	19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING)
2	178.162.223.114 178.162.223.114	28753 (LEASEWEB-...) (LEASEWEB-DE-FRA-10)
1	46.4.70.136 46.4.70.136	24940 (HETZNER-AS) (HETZNER-AS)
1	162.214.131.152 162.214.131.152	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
8	5

1 192.185.5.194 (United States)

ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: ns8067.hostgator.com

hcs2.lv53.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.162.223.114 (Berlin, Germany)

ASN28753 (LEASEWEB-DE-FRA-10, DE)
PTR: img.webme.com

img.webme.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 46.4.70.136 (Bad Muenstereifel, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.136.70.4.46.clients.your-server.de

dl.glitter-graphics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.214.131.152 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 162-214-131-152.unifiedlayer.com

www.hostgator.co.in	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	webme.com img.webme.com — Cisco Umbrella Rank: 406853
1	hostgator.co.in www.hostgator.co.in	892 KB
1	glitter-graphics.net dl.glitter-graphics.net	4 KB
1	lv53.com hcs2.lv53.com	2 KB
0	anime.web.tr Failed kod.anime.web.tr Failed
0	persiangig.com Failed drtrojan.persiangig.com Failed
0	tinypic.com Failed i52.tinypic.com Failed
8	7

	Domain	Requested by
2	img.webme.com	hcs2.lv53.com
1	www.hostgator.co.in	hcs2.lv53.com
1	dl.glitter-graphics.net	hcs2.lv53.com
1	hcs2.lv53.com
0	kod.anime.web.tr Failed	hcs2.lv53.com
0	drtrojan.persiangig.com Failed	hcs2.lv53.com
0	i52.tinypic.com Failed	hcs2.lv53.com
8	7

This site contains links to these domains. Also see Links.

Domain
tutunesonverin.net
tinypic.com
forexsohbet.com
www.cyber-warrior.org

Subject Issuer	Validity	Valid
www.wfd.lv53.com R3	`2024-01-21` - `2024-04-20`	3 months	crt.sh
img.webme.com R3	`2024-01-22` - `2024-04-21`	3 months	crt.sh
art.glitter-graphics.net R3	`2024-03-01` - `2024-05-30`	3 months	crt.sh
hostgator.co.in Sectigo RSA Domain Validation Secure Server CA	`2021-01-04` - `2022-02-04`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://hcs2.lv53.com/
Frame ID: 449196935DE5EDEBD67D34A208B9D279
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

YouTube (Video Players) Expand

Overall confidence: 100%
Detected patterns

<(?:param|embed|iframe)[^>]+youtube(?:-nocookie)?\.com/(?:v|embed)

Page Statistics

8
Requests

50 %
HTTPS

0 %
IPv6

7
Domains

7
Subdomains

5
IPs

2
Countries

898 kB
Transfer

901 kB
Size

0
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: http://tutunesonverin.net/

Search URL Search Domain Scan URL

URL: http://tinypic.com/?ref=ibw8wl

Search URL Search Domain Scan URL

URL: http://forexsohbet.com/

Search URL Search Domain Scan URL

URL: http://www.cyber-warrior.org/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
hcs2.lv53.com/ 6 KB
2 KB 656ms
156ms Document
text/html 192.185.5.194
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://hcs2.lv53.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.5.194 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: ns8067.hostgator.com
Software: Apache /
Resource Hash: c877ceb5cf3c2a81b1553b9cec262b65d433e2e8987f14e3e09d4b346cc38a15

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-length: 2216
content-type: text/html; charset=UTF-8
date: Sat, 23 Mar 2024 14:39:26 GMT
server: Apache
vary: Accept-Encoding

GET
H/1.1 404
Not Found sag_bayrak.gif
img.webme.com/pic/h/htmlkod/ 0
0 229ms
35ms Image
text/html 178.162.223.114
LEASEWEB-DE-FRA-10

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.webme.com/pic/h/htmlkod/sag_bayrak.gif
Requested by: Host: hcs2.lv53.com
URL: https://hcs2.lv53.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 178.162.223.114 Berlin, Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS: img.webme.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hcs2.lv53.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

GET ibw8wl.gif
i52.tinypic.com/ 0
0

GET
H/1.1 404
Not Found sol_bayrak.gif
img.webme.com/pic/h/htmlkod/ 0
0 230ms
36ms Image
text/html 178.162.223.114
LEASEWEB-DE-FRA-10

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.webme.com/pic/h/htmlkod/sol_bayrak.gif
Requested by: Host: hcs2.lv53.com
URL: https://hcs2.lv53.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 178.162.223.114 Berlin, Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS: img.webme.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hcs2.lv53.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

GET
H2 200 450731z7yosie5st.gif
dl.glitter-graphics.net/pub/450/ 4 KB
4 KB 185ms
26ms Image
image/gif 46.4.70.136
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dl.glitter-graphics.net/pub/450/450731z7yosie5st.gif

Requested by

Host: hcs2.lv53.com
URL: https://hcs2.lv53.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

46.4.70.136 Bad Muenstereifel, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.136.70.4.46.clients.your-server.de

Software

glig.net/1.0 /

Resource Hash

b2da3c6552c4ed579c7ef045e9f5fd6df460a750baf4a7c166e84bfea4da3c6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hcs2.lv53.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
date: Sat, 23 Mar 2024 14:39:26 GMT
x-content-type-options: nosniff
last-modified: Fri, 06 Feb 2009 03:41:20 GMT
server: glig.net/1.0
etag: "1502424436"
x-frame-options: DENY
content-type: image/gif
cache-control: max-age=41472000
accept-ranges: bytes
content-length: 4156

GET lpdq4.jpg
drtrojan.persiangig.com/ 0
0

GET
H/1.1 200
OK dalgalanan_turk_bayragi_hareketli_gif_96687_1.gif
www.hostgator.co.in/files/writeable/uploads/hostgator27232/image/ 891 KB
892 KB 1111ms
399ms Image
image/gif 162.214.131.152
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.hostgator.co.in/files/writeable/uploads/hostgator27232/image/dalgalanan_turk_bayragi_hareketli_gif_96687_1.gif

Requested by

Host: hcs2.lv53.com
URL: https://hcs2.lv53.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

162.214.131.152 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

162-214-131-152.unifiedlayer.com

Software

Apache/2.2.14 (Ubuntu) /

Resource Hash

5a40e1bb965013b91b55788c59adea78a9459ba1e2d71a8021f0871302aab3ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hcs2.lv53.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Date: Sat, 23 Mar 2024 14:39:27 GMT
X-BKSrc: 26.72
Strict-Transport-Security: max-age=31536000
Last-Modified: Fri, 25 Nov 2011 14:33:15 GMT
Server: Apache/2.2.14 (Ubuntu)
Age: 0
ETag: "df0bf68d-deca8-4b2900887e0c0"
X-Cache: MISS
Content-Type: image/gif
Content-Length: 912552

GET koruma.js
kod.anime.web.tr/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: i52.tinypic.com
URL: https://i52.tinypic.com/ibw8wl.gif

Domain: drtrojan.persiangig.com
URL: https://drtrojan.persiangig.com/lpdq4.jpg

Domain: kod.anime.web.tr
URL: http://kod.anime.web.tr/koruma.js

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

21 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: https://hcs2.lv53.com/ Message: Mixed Content: The page at 'https://hcs2.lv53.com/' was loaded over HTTPS, but requested an insecure element 'http://img.webme.com/pic/h/htmlkod/sag_bayrak.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hcs2.lv53.com/ Message: Mixed Content: The page at 'https://hcs2.lv53.com/' was loaded over HTTPS, but requested an insecure element 'http://i52.tinypic.com/ibw8wl.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hcs2.lv53.com/ Message: Mixed Content: The page at 'https://hcs2.lv53.com/' was loaded over HTTPS, but requested an insecure element 'http://img.webme.com/pic/h/htmlkod/sol_bayrak.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hcs2.lv53.com/ Message: Mixed Content: The page at 'https://hcs2.lv53.com/' was loaded over HTTPS, but requested an insecure element 'http://dl.glitter-graphics.net/pub/450/450731z7yosie5st.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hcs2.lv53.com/ Message: Mixed Content: The page at 'https://hcs2.lv53.com/' was loaded over HTTPS, but requested an insecure element 'http://drtrojan.persiangig.com/lpdq4.jpg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hcs2.lv53.com/ Message: Mixed Content: The page at 'https://hcs2.lv53.com/' was loaded over HTTPS, but requested an insecure element 'http://drtrojan.persiangig.com/lpdq4.jpg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hcs2.lv53.com/ Message: Mixed Content: The page at 'https://hcs2.lv53.com/' was loaded over HTTPS, but requested an insecure element 'http://www.hostgator.co.in/files/writeable/uploads/hostgator27232/image/dalgalanan_turk_bayragi_hareketli_gif_96687_1.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hcs2.lv53.com/(Line 160) Message: Mixed Content: The page at 'https://hcs2.lv53.com/' was loaded over HTTPS, but requested an insecure element 'http://img.webme.com/pic/h/htmlkod/sag_bayrak.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hcs2.lv53.com/(Line 160) Message: Mixed Content: The page at 'https://hcs2.lv53.com/' was loaded over HTTPS, but requested an insecure element 'http://i52.tinypic.com/ibw8wl.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hcs2.lv53.com/(Line 160) Message: Mixed Content: The page at 'https://hcs2.lv53.com/' was loaded over HTTPS, but requested an insecure element 'http://img.webme.com/pic/h/htmlkod/sol_bayrak.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
network	error	URL: https://i52.tinypic.com/ibw8wl.gif Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
security	error	URL: https://hcs2.lv53.com/ Message: Mixed Content: The page at 'https://hcs2.lv53.com/' was loaded over HTTPS, but requested an insecure script 'http://kod.anime.web.tr/koruma.js'. This request has been blocked; the content must be served over HTTPS.
security	warning	URL: https://hcs2.lv53.com/(Line 850) Message: Mixed Content: The page at 'https://hcs2.lv53.com/' was loaded over HTTPS, but requested an insecure element 'http://dl.glitter-graphics.net/pub/450/450731z7yosie5st.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hcs2.lv53.com/(Line 850) Message: Mixed Content: The page at 'https://hcs2.lv53.com/' was loaded over HTTPS, but requested an insecure element 'http://drtrojan.persiangig.com/lpdq4.jpg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hcs2.lv53.com/(Line 850) Message: Mixed Content: The page at 'https://hcs2.lv53.com/' was loaded over HTTPS, but requested an insecure element 'http://drtrojan.persiangig.com/lpdq4.jpg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://hcs2.lv53.com/(Line 850) Message: Mixed Content: The page at 'https://hcs2.lv53.com/' was loaded over HTTPS, but requested an insecure element 'http://www.hostgator.co.in/files/writeable/uploads/hostgator27232/image/dalgalanan_turk_bayragi_hareketli_gif_96687_1.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	error	URL: https://hcs2.lv53.com/ Message: Mixed Content: The page at 'https://hcs2.lv53.com/' was loaded over HTTPS, but requested an insecure plugin resource 'http://www.crazyprofile.com/textmaker/ripple.swf'. This request has been blocked; the content must be served over HTTPS.
security	error	URL: https://hcs2.lv53.com/ Message: Mixed Content: The page at 'https://hcs2.lv53.com/' was loaded over HTTPS, but requested an insecure plugin resource 'http://www.youtube.com/v/0RA1yjEIieE&autoplay=1'. This request has been blocked; the content must be served over HTTPS.
network	error	URL: https://drtrojan.persiangig.com/lpdq4.jpg Message: Failed to load resource: net::ERR_CONNECTION_REFUSED
network	error	URL: https://img.webme.com/pic/h/htmlkod/sag_bayrak.gif Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://img.webme.com/pic/h/htmlkod/sol_bayrak.gif Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

dl.glitter-graphics.net
drtrojan.persiangig.com
hcs2.lv53.com
i52.tinypic.com
img.webme.com
kod.anime.web.tr
www.hostgator.co.in
drtrojan.persiangig.com
i52.tinypic.com
kod.anime.web.tr
162.214.131.152
178.162.223.114
192.185.5.194
46.4.70.136
5a40e1bb965013b91b55788c59adea78a9459ba1e2d71a8021f0871302aab3ae
b2da3c6552c4ed579c7ef045e9f5fd6df460a750baf4a7c166e84bfea4da3c6b
c877ceb5cf3c2a81b1553b9cec262b65d433e2e8987f14e3e09d4b346cc38a15
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

hcs2.lv53.com Open in urlscan Pro 192.185.5.194 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

8 Requests

50 %HTTPS

0 %IPv6

7 Domains

7 Subdomains

5 IPs

2 Countries

898 kBTransfer

901 kBSize

0 Cookies

4 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

0 Cookies

21 Console Messages

Indicators

hcs2.lv53.com Open in urlscan Pro
192.185.5.194 Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

50 %
HTTPS

0 %
IPv6

7
Domains

7
Subdomains

5
IPs

2
Countries

898 kB
Transfer

901 kB
Size

0
Cookies

8 HTTP transactions
0 data transactions