loot-ferm.pro - urlscan.io

Summary

This website contacted 4 IPs in 4 countries across 4 domains to perform 4 HTTP transactions. The main IP is 87.236.16.49, located in Russian Federation and belongs to BEGET-AS, RU. The main domain is loot-ferm.pro.
TLS certificate: Issued by Let's Encrypt Authority X3 on May 27th 2019. Valid for: 3 months.

This is the only time loot-ferm.pro was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	87.236.16.49 87.236.16.49	198610 (BEGET-AS) (BEGET-AS)
1	46.105.233.172 46.105.233.172	16276 (OVH) (OVH)
1	2606:4700:20:... 2606:4700:20::681b:4133	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	151.101.36.193 151.101.36.193	54113 (FASTLY) (FASTLY - Fastly)
4	4

1 87.236.16.49 (Russian Federation)

ASN198610 (BEGET-AS, RU)

loot-ferm.pro	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 46.105.233.172 (France)

ASN16276 (OVH, FR)
PTR: loot.farm

loot.farm	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::681b:4133 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

pt.cs.deals	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.36.193 (Amsterdam, Netherlands)

ASN54113 (FASTLY - Fastly, US)

i.imgur.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	imgur.com i.imgur.com	338 KB
1	cs.deals pt.cs.deals	21 KB
1	loot.farm loot.farm	2 KB
1	loot-ferm.pro loot-ferm.pro	846 B
4	4

	Domain	Requested by
1	i.imgur.com	loot-ferm.pro
1	pt.cs.deals	loot-ferm.pro
1	loot.farm	loot-ferm.pro
1	loot-ferm.pro
4	4

This site contains links to these domains. Also see Links.

Domain
loor-farm.site

Subject Issuer	Validity	Valid
loot-ferm.pro Let's Encrypt Authority X3	`2019-05-27` - `2019-08-25`	3 months	crt.sh
loot.farm COMODO RSA Domain Validation Secure Server CA	`2017-11-18` - `2019-11-18`	2 years	crt.sh
ssl373843.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-05-08` - `2019-11-14`	6 months	crt.sh
*.imgur.com DigiCert SHA2 Secure Server CA	`2018-12-14` - `2020-02-12`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://loot-ferm.pro/
Frame ID: 3B295D269B7AE575E163BD4706CC1956
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

4
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

4
Countries

362 kB
Transfer

364 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://loor-farm.site/
Title:

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response loot-ferm.pro/	1 KB 846 B	214ms 94ms	Document text/html	87.236.16.49 BEGET-AS
General Check archive.org Show headers Download Go to Full URL https://loot-ferm.pro/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 87.236.16.49 , Russian Federation, ASN198610 (BEGET-AS, RU), Reverse DNS Software nginx-reuseport/1.13.4 / Resource Hash `10176a79846bacb656b7224e4837a409d80c95aff56631450a2dce8b10c98e67` Request headers :method GET :authority loot-ferm.pro :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers status 200 server nginx-reuseport/1.13.4 date Tue, 28 May 2019 04:57:18 GMT content-type text/html vary Accept-Encoding last-modified Tue, 28 May 2019 04:53:00 GMT etag W/"5b7-589eb7074d5cb" content-encoding gzip
GET H/1.1	200 OK	lootlogo.svg loot.farm/images/	4 KB 2 KB	106ms 21ms	Image image/svg+xml	46.105.233.172 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://loot.farm/images/lootlogo.svg Requested by Host: loot-ferm.pro URL: https://loot-ferm.pro/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 46.105.233.172 , France, ASN16276 (OVH, FR), Reverse DNS loot.farm Software nginx / Resource Hash `291f83604eb7a3ee51aef663efa19d4bd526ce145e77cd5e3348725d01a71e81` Request headers Referer https://loot-ferm.pro/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 28 May 2019 04:57:18 GMT Content-Encoding gzip Last-Modified Tue, 04 Jul 2017 21:17:37 GMT Server nginx ETag W/"595c05f1-1196" Vary Accept-Encoding Content-Type image/svg+xml Cache-Control max-age=2592000, public Transfer-Encoding chunked Connection keep-alive Expires Thu, 27 Jun 2019 04:57:18 GMT
GET H2	200	steam_sign_in_big.png pt.cs.deals/images/	21 KB 21 KB	480ms 404ms	Image image/webp	2606:4700:20::681b:4133 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://pt.cs.deals/images/steam_sign_in_big.png Requested by Host: loot-ferm.pro URL: https://loot-ferm.pro/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681b:4133 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `2ffaba319276d7aa372c971836af955ece55afdf9f0d97952588b44c32c680f7` Request headers Referer https://loot-ferm.pro/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Tue, 28 May 2019 04:57:18 GMT cf-cache-status REVALIDATED cf-polished origFmt=png, origSize=26354 status 200 content-disposition inline; filename="steam_sign_in_big.webp" cf-bgj imgq:85 content-length 21028 last-modified Wed, 26 Jul 2017 20:43:02 GMT server cloudflare etag "5978fed6-66f2" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp cache-control public, max-age=7200 accept-ranges bytes cf-ray 4ddda5a29c359742-FRA expires Tue, 28 May 2019 06:57:18 GMT
GET H2	200	Q2l8rzJ.png i.imgur.com/	338 KB 338 KB	106ms 32ms	Image image/png	151.101.36.193 Fastly
General Check archive.org Show headers Download Go to Show image Full URL https://i.imgur.com/Q2l8rzJ.png Requested by Host: loot-ferm.pro URL: https://loot-ferm.pro/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.36.193 Amsterdam, Netherlands, ASN54113 (FASTLY - Fastly, US), Reverse DNS Software cat factory 1.0 / Resource Hash `cbfdc38f4a00c20b6a6233a2f448dd40fa20b4215ac3f189fd3fd39e3348481e` Request headers Referer https://loot-ferm.pro/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Tue, 28 May 2019 04:57:18 GMT age 54395 x-cache MISS, HIT status 200 content-length 346005 x-served-by cache-bwi5137-BWI, cache-ams21023-AMS last-modified Fri, 15 Mar 2019 01:01:01 GMT server cat factory 1.0 x-timer S1559019438.495879,VS0,VE5 etag "a237d93a44aef25bf7bfbec7c365b5ac" access-control-allow-methods GET, OPTIONS content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes x-cache-hits 0, 1

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

i.imgur.com
loot-ferm.pro
loot.farm
pt.cs.deals
151.101.36.193
2606:4700:20::681b:4133
46.105.233.172
87.236.16.49
10176a79846bacb656b7224e4837a409d80c95aff56631450a2dce8b10c98e67
291f83604eb7a3ee51aef663efa19d4bd526ce145e77cd5e3348725d01a71e81
2ffaba319276d7aa372c971836af955ece55afdf9f0d97952588b44c32c680f7
cbfdc38f4a00c20b6a6233a2f448dd40fa20b4215ac3f189fd3fd39e3348481e

loot-ferm.pro Open in urlscan Pro 87.236.16.49 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

4 Requests

100 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

4 IPs

4 Countries

362 kBTransfer

364 kBSize

0 Cookies

1 Outgoing links

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

0 Cookies

Indicators

loot-ferm.pro Open in urlscan Pro
87.236.16.49 Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

4
Countries

362 kB
Transfer

364 kB
Size

0
Cookies

4 HTTP transactions
0 data transactions