loki.tel - urlscan.io

Summary

This website contacted 2 IPs in 2 countries across 1 domains to perform 3 HTTP transactions. The main IP is 89.58.18.247, located in Vienna, Austria and belongs to NETCUP-AS netcup GmbH, DE. The main domain is loki.tel. The Cisco Umbrella rank of the primary domain is 638586.
TLS certificate: Issued by E5 on July 12th 2024. Valid for: 3 months.

This is the only time loki.tel was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	89.58.41.251 89.58.41.251	197540 (NETCUP-AS...) (NETCUP-AS netcup GmbH)
1	89.58.18.247 89.58.18.247	197540 (NETCUP-AS...) (NETCUP-AS netcup GmbH)
3	2

2 89.58.41.251 (Nuremberg, Germany)

ASN197540 (NETCUP-AS netcup GmbH, DE)
PTR: 03.nur.exit.tor.loki.tel

89.58.41.251	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 89.58.18.247 (Vienna, Austria)

ASN197540 (NETCUP-AS netcup GmbH, DE)
PTR: master-control-program.operations.zone

loki.tel	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	loki.tel loki.tel — Cisco Umbrella Rank: 638586	4 KB
3	1

	Domain	Requested by
1	loki.tel
3	1

This site contains links to these domains. Also see Links.

Domain
metrics.torproject.org
en.wikipedia.org
www.gesetze-im-internet.de
www.ris.bka.gv.at
wetten.overheid.nl
de.wikipedia.org
nl.wikipedia.org
www.bundesnetzagentur.de
www.torproject.org
www.eff.org
prism-break.org
munin.loki.tel
status.loki.tel
chaos.social

Subject Issuer	Validity	Valid
loki.tel E5	`2024-07-12` - `2024-10-10`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://loki.tel/
Frame ID: E03EB8019AB0C326512EDE573D1A059D
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

The Onion Router

Page URL History Show full URLs

http://89.58.41.251/ HTTP 307
https://89.58.41.251/ HTTP 307
http://89.58.41.251/ Page URL
https://loki.tel/ Page URL

Page Statistics

3
Requests

33 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

2
Countries

4 kB
Transfer

9 kB
Size

0
Cookies

14 Outgoing links

These are links going to different origins than the main page.

URL: https://metrics.torproject.org/rs.html#search/family:824862C40A81327DE807F44A7DB9827A62B86B57
Title: loki.tel Tor nodes

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/Tor_(network)
Title: Tor (network)

Search URL Search Domain Scan URL

URL: https://www.gesetze-im-internet.de/tmg/__8.html
Title: TMG 8

Search URL Search Domain Scan URL

URL: http://www.ris.bka.gv.at/Dokument.wxe?Abfrage=Bundesnormen&Dokumentnummer=NOR40025809
Title: ECG 13

Search URL Search Domain Scan URL

URL: http://wetten.overheid.nl/BWBR0005289/Boek6/Titel3/Afdeling4A/Artikel196c/
Title: Article 6:196c BW

Search URL Search Domain Scan URL

URL: https://de.wikipedia.org/wiki/Tor_(Netzwerk)
Title: Tor (Netzwerk)

Search URL Search Domain Scan URL

URL: https://nl.wikipedia.org/wiki/Tor_(netwerk)
Title: Tor (netwerk)

Search URL Search Domain Scan URL

URL: https://www.bundesnetzagentur.de/SharedDocs/Downloads/DE/Sachgebiete/Telekommunikation/Unternehmen_Institutionen/Anbieterpflichten/Meldepflicht/TKDiensteanbieterXLS_3_12.html
Title: Registered companies (as of 03/04/24)

Search URL Search Domain Scan URL

URL: https://www.torproject.org/
Title: Tor-Project •

Search URL Search Domain Scan URL

URL: https://www.eff.org/
Title: Electronic Frontier Foundation •

Search URL Search Domain Scan URL

URL: https://prism-break.org/
Title: Prism Break •

Search URL Search Domain Scan URL

URL: https://munin.loki.tel/tor.loki.tel/index.html
Title: Statistics •

Search URL Search Domain Scan URL

URL: https://status.loki.tel/
Title: Monitoring •

Search URL Search Domain Scan URL

URL: https://chaos.social/@coacx
Title: Mastodon

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://89.58.41.251/ HTTP 307
https://89.58.41.251/ HTTP 307
http://89.58.41.251/ Page URL
https://loki.tel/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://89.58.41.251/ HTTP 307
https://89.58.41.251/ HTTP 307
http://89.58.41.251/

3 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.0

200
OK

/ Show response
89.58.41.251/
Redirect Chain

http://89.58.41.251/
https://89.58.41.251/
http://89.58.41.251/

63 B
268 B

713ms
713ms

Document
text/html

89.58.41.251
NETCUP-AS netcup ...

General

Check archive.org

Show headers Download Go to

Full URL: http://89.58.41.251/
Protocol: HTTP/1.0
Server: 89.58.41.251 Nuremberg, Germany, ASN197540 (NETCUP-AS netcup GmbH, DE),
Reverse DNS: 03.nur.exit.tor.loki.tel
Software: /
Resource Hash: 52541a72c2bf1098e49437cae1c440db544f58e80ec72b5e1f0ecff804a44ee3

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Encoding: identity
Content-Length: 63
Content-Type: text/html
Date: Fri, 13 Sep 2024 14:56:57 GMT
Expires: Fri, 13 Sep 2024 15:16:57 GMT
X-Your-Address-Is: 178.249.214.135

Redirect headers

Location: http://89.58.41.251/
Non-Authoritative-Reason: HttpsUpgrades

GET
H2 200 Primary Request / Show response
loki.tel/ 9 KB
4 KB 1779ms
126ms Document
text/html 89.58.18.247
NETCUP-AS netcup ...

General

Check archive.org

Show headers Download Go to

Full URL

https://loki.tel/

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

89.58.18.247 Vienna, Austria, ASN197540 (NETCUP-AS netcup GmbH, DE),

Reverse DNS

master-control-program.operations.zone

Software

nginx /

Resource Hash

169093dd5e3500445cd6d52d60cbf6883051e529e9557d845f2463504dd149d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://89.58.41.251/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html
date: Fri, 13 Sep 2024 14:56:59 GMT
etag: W/"66008039-22e4"
last-modified: Sun, 24 Mar 2024 19:34:17 GMT
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

GET
H/1.0 404
Not found favicon.ico
89.58.41.251/ 0
63 B 231ms
116ms Other
text/plain 89.58.41.251
NETCUP-AS netcup ...

General

Check archive.org

Show headers Download Go to

Full URL: http://89.58.41.251/favicon.ico
Protocol: HTTP/1.0
Server: 89.58.41.251 Nuremberg, Germany, ASN197540 (NETCUP-AS netcup GmbH, DE),
Reverse DNS: 03.nur.exit.tor.loki.tel
Software: /
Resource Hash

Request headers

Referer: http://89.58.41.251/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Fri, 13 Sep 2024 14:56:57 GMT

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://89.58.41.251/favicon.ico Message: Failed to load resource: the server responded with a status of 404 (Not found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

loki.tel
89.58.18.247
89.58.41.251
169093dd5e3500445cd6d52d60cbf6883051e529e9557d845f2463504dd149d3
52541a72c2bf1098e49437cae1c440db544f58e80ec72b5e1f0ecff804a44ee3

loki.tel Open in urlscan Pro 89.58.18.247 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

3 Requests

33 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

2 Countries

4 kBTransfer

9 kBSize

0 Cookies

14 Outgoing links

Page URL History

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

loki.tel Open in urlscan Pro
89.58.18.247 Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

33 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

2
Countries

4 kB
Transfer

9 kB
Size

0
Cookies

3 HTTP transactions
0 data transactions