51761.lootynews.com Open in urlscan Pro
213.174.135.1  Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. http://ttgmjfgldgv9ed10.com/SRC/SRC.php?c=1792832&c1=VAR Page URL
2. https://ttgmjfgldgv9ed10.com/?r=dir&zoneid=1792832&var=VAR&pb=9789d17bc87fc6ee9ab5e45e15236db31624879682&psp=HvhAXyDifshAfa0Sunq4w8-LzjrC4dqru3IyMRvji5bNhanLNZRBgv6w27Ay4aaZdBVbtIfegiXuGN2kJNlCt2HGNSQnTzR9xnobj-yT0KodvSAikMPITAKfTXsrTOi8w4hVrArH42CyTq-w546215HtWdj8dwUKRfe3sGiD2GcwcBkwfM30llZWDFfpjg27Xa3kPx3nRCjRaJXJ2j2wwAVJRGn0bHsI4QBK5RJqkfG_kJHK6QYWLwJJGSPq3zs9q1SOi_rei59GfZItHuKwPdotsmOyAWFM0cc3KXQkeM9Z-7HKsUwy4p20-A7Qa44ooEPc1vdn4EW7yL5MX0HecHq5Mw1HF6GF0W9e2ZVsqYEDsSIJjgsrs8s46J_pEPVX3phiITub2baQPtCm1IU76qfcmglOWhCaGzhKndsQYZxTTY0A4EZTA53CsQ3LeJ_Z30Uhrl5y1-zrPwqlejqmmrU_xz8cWShb8iTi_ScjTxZ1OLMwiFNJYS4O7ulWT2_VYsoq05_3LO4iN5cVZB0QHuk98ImgQ_cIztRQAHyMenq5nR8roLumpC76o9ppHZpfbQezcvhHKOWNyjbTFHuhrM6G07JdVrEW9lG1nV2aENAR0yz1bYlz9M6adAjjDtl2AmYf6XDE9hMQJ3s=&nojs=0&ix=0&t=0&x=1600&y=1200&wcks=1&wgl=0&cnvs=1&os=-120&md=0&lang=en-US&2 Page URL
3. https://51761.lootynews.com/dannig/tube-player/?var=1792832&ymid=21062804280501e6fc7103462596af6263ab&rc=1&mrc=0&fsc=0&zoneid=1601571&tburl=https://play-vids.com/?geo=pl&proxy=true Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Cookie set SRC.php Show response ttgmjfgldgv9ed10.com/SRC/	1 KB 2 KB	103ms 69ms	Document text/html	109.206.162.83 SERVEREL-AS
General Check archive.org Show headers Download Go to Full URL http://ttgmjfgldgv9ed10.com/SRC/SRC.php?c=1792832&c1=VAR Protocol HTTP/1.1 Server 109.206.162.83 , Netherlands, ASN50245 (SERVEREL-AS, NL), Reverse DNS 83.162.serverel.net Software nginx / Resource Hash 426e3e4b5e328f4d44b1b86e690f0b545734e5ab3026f96ec48a69dba9ff1ee9 Request headers Host ttgmjfgldgv9ed10.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Server nginx Date Mon, 28 Jun 2021 09:28:02 GMT Content-Type text/html; charset=utf-8 Transfer-Encoding chunked Connection keep-alive Vary Accept-Encoding Set-Cookie UID=2106280428e346a2a53881428a95375ab2d7; Path=/; SameSite=None; Expires=Tue, 28 Jun 2022 09:28:02 GMT; HttpOnly; Secure Content-Encoding gzip Timing-Allow-Origin *
GET H/1.1	200 OK	submit.min.js Show response ttgmjfgldgv9ed10.com/	31 KB 13 KB	49ms 48ms	Script application/javascript	109.206.162.83 SERVEREL-AS
General Check archive.org Show headers Download Go to Full URL http://ttgmjfgldgv9ed10.com/submit.min.js?2.0 Requested by Host: ttgmjfgldgv9ed10.com URL: http://ttgmjfgldgv9ed10.com/SRC/SRC.php?c=1792832&c1=VAR Protocol HTTP/1.1 Server 109.206.162.83 , Netherlands, ASN50245 (SERVEREL-AS, NL), Reverse DNS 83.162.serverel.net Software nginx / Resource Hash 1513289ea273cd822d56a4393350d55a7b79229dde91bf14561325b88df64810 Request headers Pragma no-cache Accept-Encoding gzip, deflate Host ttgmjfgldgv9ed10.com Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept */* Cache-Control no-cache Connection keep-alive Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 28 Jun 2021 09:28:02 GMT Content-Encoding gzip Last-Modified Tue, 08 Jun 2021 13:58:40 GMT Server nginx ETag W/"60bf7790-7c40" Transfer-Encoding chunked Content-Type application/javascript Connection keep-alive Timing-Allow-Origin *
GET H/1.1	200 OK	Cookie set / Show response ttgmjfgldgv9ed10.com/	907 B 1 KB	197ms 50ms	Document text/html	109.206.162.83 SERVEREL-AS
General Check archive.org Show headers Download Go to Full URL https://ttgmjfgldgv9ed10.com/?r=dir&zoneid=1792832&var=VAR&pb=9789d17bc87fc6ee9ab5e45e15236db31624879682&psp=HvhAXyDifshAfa0Sunq4w8-LzjrC4dqru3IyMRvji5bNhanLNZRBgv6w27Ay4aaZdBVbtIfegiXuGN2kJNlCt2HGNSQnTzR9xnobj-yT0KodvSAikMPITAKfTXsrTOi8w4hVrArH42CyTq-w546215HtWdj8dwUKRfe3sGiD2GcwcBkwfM30llZWDFfpjg27Xa3kPx3nRCjRaJXJ2j2wwAVJRGn0bHsI4QBK5RJqkfG_kJHK6QYWLwJJGSPq3zs9q1SOi_rei59GfZItHuKwPdotsmOyAWFM0cc3KXQkeM9Z-7HKsUwy4p20-A7Qa44ooEPc1vdn4EW7yL5MX0HecHq5Mw1HF6GF0W9e2ZVsqYEDsSIJjgsrs8s46J_pEPVX3phiITub2baQPtCm1IU76qfcmglOWhCaGzhKndsQYZxTTY0A4EZTA53CsQ3LeJ_Z30Uhrl5y1-zrPwqlejqmmrU_xz8cWShb8iTi_ScjTxZ1OLMwiFNJYS4O7ulWT2_VYsoq05_3LO4iN5cVZB0QHuk98ImgQ_cIztRQAHyMenq5nR8roLumpC76o9ppHZpfbQezcvhHKOWNyjbTFHuhrM6G07JdVrEW9lG1nV2aENAR0yz1bYlz9M6adAjjDtl2AmYf6XDE9hMQJ3s=&nojs=0&ix=0&t=0&x=1600&y=1200&wcks=1&wgl=0&cnvs=1&os=-120&md=0&lang=en-US&2 Requested by Host: ttgmjfgldgv9ed10.com URL: http://ttgmjfgldgv9ed10.com/submit.min.js?2.0 Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_CBC Server 109.206.162.83 , Netherlands, ASN50245 (SERVEREL-AS, NL), Reverse DNS 83.162.serverel.net Software nginx / Resource Hash 4518f146b9dac6b5a3f65a73a450d1e6ad3a16efa384b9ac44f6ca575263c5f0 Request headers Host ttgmjfgldgv9ed10.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Server nginx Date Mon, 28 Jun 2021 09:28:02 GMT Content-Type text/html; charset=utf-8 Transfer-Encoding chunked Connection keep-alive Vary Accept-Encoding Set-Cookie UID=2106280428120182f7309746bfae5389523d; Path=/; SameSite=None; Expires=Tue, 28 Jun 2022 09:28:02 GMT; HttpOnly; Secure OXCCLK=ABPemAAAAAAAAAAB; Path=/; SameSite=None; Expires=Tue, 29 Jun 2021 09:28:02 GMT; Secure OXPCLK=AAHg4AAAAAAAAAAB; Path=/; SameSite=None; Expires=Tue, 29 Jun 2021 09:28:02 GMT; Secure ppucnt=1; Path=/; SameSite=None; Expires=Tue, 29 Jun 2021 09:28:02 GMT; Secure Content-Encoding gzip Timing-Allow-Origin *
GET H2	200	Primary Request / Show response 51761.lootynews.com/dannig/tube-player/	15 KB 16 KB	365ms 271ms	Document text/html	213.174.135.1 ADVANCEDHOSTERS-AS
General Check archive.org Show headers Download Go to Full URL https://51761.lootynews.com/dannig/tube-player/?var=1792832&ymid=21062804280501e6fc7103462596af6263ab&rc=1&mrc=0&fsc=0&zoneid=1601571&tburl=https://play-vids.com/?geo=pl&proxy=true Requested by Host: ttgmjfgldgv9ed10.com URL: https://ttgmjfgldgv9ed10.com/?r=dir&zoneid=1792832&var=VAR&pb=9789d17bc87fc6ee9ab5e45e15236db31624879682&psp=HvhAXyDifshAfa0Sunq4w8-LzjrC4dqru3IyMRvji5bNhanLNZRBgv6w27Ay4aaZdBVbtIfegiXuGN2kJNlCt2HGNSQnTzR9xnobj-yT0KodvSAikMPITAKfTXsrTOi8w4hVrArH42CyTq-w546215HtWdj8dwUKRfe3sGiD2GcwcBkwfM30llZWDFfpjg27Xa3kPx3nRCjRaJXJ2j2wwAVJRGn0bHsI4QBK5RJqkfG_kJHK6QYWLwJJGSPq3zs9q1SOi_rei59GfZItHuKwPdotsmOyAWFM0cc3KXQkeM9Z-7HKsUwy4p20-A7Qa44ooEPc1vdn4EW7yL5MX0HecHq5Mw1HF6GF0W9e2ZVsqYEDsSIJjgsrs8s46J_pEPVX3phiITub2baQPtCm1IU76qfcmglOWhCaGzhKndsQYZxTTY0A4EZTA53CsQ3LeJ_Z30Uhrl5y1-zrPwqlejqmmrU_xz8cWShb8iTi_ScjTxZ1OLMwiFNJYS4O7ulWT2_VYsoq05_3LO4iN5cVZB0QHuk98ImgQ_cIztRQAHyMenq5nR8roLumpC76o9ppHZpfbQezcvhHKOWNyjbTFHuhrM6G07JdVrEW9lG1nV2aENAR0yz1bYlz9M6adAjjDtl2AmYf6XDE9hMQJ3s=&nojs=0&ix=0&t=0&x=1600&y=1200&wcks=1&wgl=0&cnvs=1&os=-120&md=0&lang=en-US&2 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 213.174.135.1 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL), Reverse DNS Software nginx/1.16.1 / Resource Hash 3c448cc09cfba0b4527d2ffee63e412e786690d252f836fe1788ce90f17e4365 Request headers :method GET :authority 51761.lootynews.com :scheme https :path /dannig/tube-player/?var=1792832&ymid=21062804280501e6fc7103462596af6263ab&rc=1&mrc=0&fsc=0&zoneid=1601571&tburl=https://play-vids.com/?geo=pl&proxy=true pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 28 Jun 2021 09:28:02 GMT content-type text/html; charset=utf-8 content-length 15569 server nginx/1.16.1 last-modified Fri, 25 Dec 2020 10:36:33 GMT etag 94972f369319865e0f37347ef6966130 x-timestamp 1608892592.59639 x-trans-id tx9bf3ad67a177499094ab5-0060d99620 x-openstack-request-id tx9bf3ad67a177499094ab5-0060d99620 cache-control max-age=172800 access-control-allow-origin * access-control-allow-methods HEAD,GET,POST,PUT,PATCH,DELETE,OPTIONS access-control-allow-headers Content-Type,X-Requested-With,X-Auth-Token,X-Openstack-Request-Id,X-Container-Meta-type,X-Container-Meta-Temp-URL-Key,Authorization access-control-expose-headers X-Container-Meta-Temp-Url-Key,X-Container-Bytes-Used,Last-Modified,X-Timestamp expires Wed, 30 Jun 2021 09:28:02 GMT x-proxy-cache MISS accept-ranges bytes
GET H2	200	script.js Show response 2818.lootynews.com/dannig/tube-player/js/	2 KB 3 KB	54ms 53ms	Script text/javascript	213.174.135.1 ADVANCEDHOSTERS-AS
General Check archive.org Show headers Download Go to Full URL https://2818.lootynews.com/dannig/tube-player/js/script.js?a=2 Requested by Host: 51761.lootynews.com URL: https://51761.lootynews.com/dannig/tube-player/?var=1792832&ymid=21062804280501e6fc7103462596af6263ab&rc=1&mrc=0&fsc=0&zoneid=1601571&tburl=https://play-vids.com/?geo=pl&proxy=true Protocol H2 Security TLS 1.3, , AES_256_GCM Server 213.174.135.1 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL), Reverse DNS Software nginx/1.16.1 / Resource Hash f0e32fad7bc82eaf5716d05eee828d09ad0705b977a5fa3eb74d8e920b6eba2a Request headers Referer https://51761.lootynews.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 28 Jun 2021 09:28:02 GMT x-openstack-request-id tx67c60dfb188246c9b32f3-006022846e x-trans-id tx67c60dfb188246c9b32f3-006022846e x-timestamp 1608892560.82013 accept-ranges bytes expires Wed, 30 Jun 2021 09:28:02 GMT last-modified Fri, 25 Dec 2020 10:36:01 GMT server nginx/1.16.1 etag 9782caf09fa09a240f657e4cb7eb08e3 access-control-allow-methods HEAD,GET,POST,PUT,PATCH,DELETE,OPTIONS content-type text/javascript access-control-allow-origin * access-control-expose-headers X-Container-Meta-Temp-Url-Key,X-Container-Bytes-Used,Last-Modified,X-Timestamp cache-control max-age=172800 content-length 2559 access-control-allow-headers Content-Type,X-Requested-With,X-Auth-Token,X-Openstack-Request-Id,X-Container-Meta-type,X-Container-Meta-Temp-URL-Key x-proxy-cache HIT
GET H2	200	skip-button.webp 321.lootynews.com/dannig/tube-player/img/	5 KB 5 KB	55ms 54ms	Image image/webp	213.174.135.1 ADVANCEDHOSTERS-AS
General Check archive.org Show headers Download Go to Show image Full URL https://321.lootynews.com/dannig/tube-player/img/skip-button.webp Requested by Host: 51761.lootynews.com URL: https://51761.lootynews.com/dannig/tube-player/?var=1792832&ymid=21062804280501e6fc7103462596af6263ab&rc=1&mrc=0&fsc=0&zoneid=1601571&tburl=https://play-vids.com/?geo=pl&proxy=true Protocol H2 Security TLS 1.3, , AES_256_GCM Server 213.174.135.1 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL), Reverse DNS Software nginx/1.16.1 / Resource Hash 4d1449898da756c5bff9e9696a2c71ea1ab9e6e96c5dfec29885a63ac237eb3b Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 28 Jun 2021 09:28:02 GMT x-openstack-request-id tx79fac3c8e8ac4ab08e555-006022846e x-trans-id tx79fac3c8e8ac4ab08e555-006022846e x-timestamp 1608540262.03735 accept-ranges bytes expires Wed, 30 Jun 2021 09:28:02 GMT last-modified Mon, 21 Dec 2020 08:44:23 GMT server nginx/1.16.1 etag da2dc41d023f4fcc89675351f9117c3d access-control-allow-methods HEAD,GET,POST,PUT,PATCH,DELETE,OPTIONS content-type image/webp access-control-allow-origin * access-control-expose-headers X-Container-Meta-Temp-Url-Key,X-Container-Bytes-Used,Last-Modified,X-Timestamp cache-control max-age=172800 content-length 5006 access-control-allow-headers Content-Type,X-Requested-With,X-Auth-Token,X-Openstack-Request-Id,X-Container-Meta-type,X-Container-Meta-Temp-URL-Key x-proxy-cache HIT

31 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| requestPermission string| url_string object| url string| source string| clickid number| reloadCount string| BASE_SW_SCRIPT_SRC number| maxReloadCount number| zoneid string| trafficbackUrl string| src object| full_domain string| domain function| getReloadCount function| getRandomSubdomain function| changeSubdomain string| target_url function| back function| forward undefined| trafficbackUrlFinal

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://2818.lootynews.com/dannig/tube-player/js/script.js?a=2(Line 16) Message: lootynews.com

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

2818.lootynews.com
321.lootynews.com
51761.lootynews.com
ttgmjfgldgv9ed10.com
109.206.162.83
213.174.135.1
1513289ea273cd822d56a4393350d55a7b79229dde91bf14561325b88df64810
3c448cc09cfba0b4527d2ffee63e412e786690d252f836fe1788ce90f17e4365
426e3e4b5e328f4d44b1b86e690f0b545734e5ab3026f96ec48a69dba9ff1ee9
4518f146b9dac6b5a3f65a73a450d1e6ad3a16efa384b9ac44f6ca575263c5f0
4d1449898da756c5bff9e9696a2c71ea1ab9e6e96c5dfec29885a63ac237eb3b
f0e32fad7bc82eaf5716d05eee828d09ad0705b977a5fa3eb74d8e920b6eba2a