qtteddybear.com Open in urlscan Pro
154.16.249.214 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.rentv.com/phpAds/adclick.php?bannerid=116&zoneid=316&source=&dest=http://burke-walters.pushpencildesign.eu...
Effective URL:
https://qtteddybear.com/0/0/0/29239184c4e530aa342014d3130d9163/1_152594_2595998/1533_3068234_3372067_40/446800771
Submission: On February 24 via api (February 24th 2022, 1:53:51 pm UTC) from BE — Scanned from DE

Summary HTTP 2 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 4 domains to perform 2 HTTP transactions. The main IP is 154.16.249.214, located in United States and belongs to ASDETUK www.heficed.com, GB. The main domain is qtteddybear.com.
TLS certificate: Issued by R3 on December 27th 2021. Valid for: 3 months.

This is the only time qtteddybear.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	178.128.176.49 178.128.176.49	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1 1	217.112.43.153 217.112.43.153	40966 (VALUEHOST...) (VALUEHOST-AS ValueHOST Cloud Network)
1	154.16.249.214 154.16.249.214	61317 (ASDETUK w...) (ASDETUK www.heficed.com)
1	172.245.240.81 172.245.240.81	36352 (AS-COLOCR...) (AS-COLOCROSSING)
2	2

1 178.128.176.49 (Santa Clara, United States) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: ubuntu-18.04-sfo

www.rentv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 217.112.43.153 (United Kingdom) 1 redirects

ASN40966 (VALUEHOST-AS ValueHOST Cloud Network, GB)
PTR: kickback.lanesdelusions.com

burke-walters.pushpencildesign.eu.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 154.16.249.214 (United States)

ASN61317 (ASDETUK www.heficed.com, GB)
PTR: 154-16-249-214.segoservers.com

qtteddybear.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.245.240.81 (Elk Grove Village, United States)

ASN36352 (AS-COLOCROSSING, US)
PTR: 172-245-240-81-host.colocrossing.com

t9yow.deskcounted.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	deskcounted.com t9yow.deskcounted.com	341 B
1	qtteddybear.com qtteddybear.com	446 B
1	eu.com 1 redirects burke-walters.pushpencildesign.eu.com	278 B
1	rentv.com 1 redirects www.rentv.com	373 B
2	4

	Domain	Requested by
1	t9yow.deskcounted.com	qtteddybear.com
1	qtteddybear.com
1	burke-walters.pushpencildesign.eu.com	1 redirects
1	www.rentv.com	1 redirects
2	4

This site contains no links.

Subject Issuer	Validity	Valid
qtteddybear.com R3	`2021-12-27` - `2022-03-27`	3 months	crt.sh
deskcounted.com R3	`2022-01-22` - `2022-04-22`	3 months	crt.sh

This page contains 1 frames:

Frame: https://t9yow.deskcounted.com/?kw=31&s2=683052365
Frame ID: E4F3AD26B2E70BFB9405FBE60888775D
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://www.rentv.com/phpAds/adclick.php?bannerid=116&zoneid=316&source=&dest=http://burke-walters... HTTP 302
http://burke-walters.pushpencildesign.eu.com/yEKCzsMWwrYJ70cAzx8WGVOFZC4aTgtETvPkuW4kwVNmxpMHR0sKOGE8adw4cscJ8Um.cfc?dmhC... HTTP 302
https://qtteddybear.com/0/0/0/29239184c4e530aa342014d3130d9163/1_152594_2595998/1533_3068234_3372067... Page URL

Page Statistics

2
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

2
IPs

2
Countries

1 kB
Transfer

0 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.rentv.com/phpAds/adclick.php?bannerid=116&zoneid=316&source=&dest=http://burke-walters.pushpencildesign.eu.com/yEKCzsMWwrYJ70cAzx8WGVOFZC4aTgtETvPkuW4kwVNmxpMHR0sKOGE8adw4cscJ8Um.cfc?dmhCY6cc0PH5cx3fdccc84cMc2Zf2dg15cbbb2V HTTP 302
http://burke-walters.pushpencildesign.eu.com/yEKCzsMWwrYJ70cAzx8WGVOFZC4aTgtETvPkuW4kwVNmxpMHR0sKOGE8adw4cscJ8Um.cfc?dmhCY6cc0PH5cx3fdccc84cMc2Zf2dg15cbbb2V HTTP 302
https://qtteddybear.com/0/0/0/29239184c4e530aa342014d3130d9163/1_152594_2595998/1533_3068234_3372067_40/446800771 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request 446800771 Show response
qtteddybear.com/0/0/0/29239184c4e530aa342014d3130d9163/1_152594_2595998/1533_3068234_3372067_40/
Redirect Chain

http://www.rentv.com/phpAds/adclick.php?bannerid=116&zoneid=316&source=&dest=http://burke-walters.pushpencildesign.eu.com/yEKCzsMWwrYJ70cAzx8WGVOFZC4aTgtETvPkuW4kwVNmxpMHR0sKOGE8adw4cscJ8Um.cfc?dmh...
http://burke-walters.pushpencildesign.eu.com/yEKCzsMWwrYJ70cAzx8WGVOFZC4aTgtETvPkuW4kwVNmxpMHR0sKOGE8adw4cscJ8Um.cfc?dmhCY6cc0PH5cx3fdccc84cMc2Zf2dg15cbbb2V
https://qtteddybear.com/0/0/0/29239184c4e530aa342014d3130d9163/1_152594_2595998/1533_3068234_3372067_40/446800771

112 B
446 B

1201ms
545ms

Document
text/html

154.16.249.214
ASDETUK www.hefic...

General

Check archive.org

Show headers Download Go to

Full URL: https://qtteddybear.com/0/0/0/29239184c4e530aa342014d3130d9163/1_152594_2595998/1533_3068234_3372067_40/446800771
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 154.16.249.214 , United States, ASN61317 (ASDETUK www.heficed.com, GB),
Reverse DNS: 154-16-249-214.segoservers.com
Software: Apache /
Resource Hash: 883dce7fbc72e1f569fa9bd836d2052644da5c86157c6f898aa10211c31f7657

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Thu, 24 Feb 2022 13:53:45 GMT
content-type: text/html; charset=UTF-8
server: Apache
content-encoding: gzip
transfer-encoding: chunked
vary: Accept-Encoding

Redirect headers

Date: Thu, 24 Feb 2022 13:53:43 GMT
Server: Apache
Location: https://qtteddybear.com/0/0/0/29239184c4e530aa342014d3130d9163/1_152594_2595998/1533_3068234_3372067_40/446800771
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8

GET
H/1.1 404
Not Found / Show response
t9yow.deskcounted.com/ 0
341 B 552ms
147ms Document
text/html 172.245.240.81
AS-COLOCROSSING

General

Check archive.org

Show headers Download Go to

Full URL

https://t9yow.deskcounted.com/?kw=31&s2=683052365

Requested by

Host: qtteddybear.com
URL: https://qtteddybear.com/0/0/0/29239184c4e530aa342014d3130d9163/1_152594_2595998/1533_3068234_3372067_40/446800771

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

172.245.240.81 Elk Grove Village, United States, ASN36352 (AS-COLOCROSSING, US),

Reverse DNS

172-245-240-81-host.colocrossing.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://qtteddybear.com/

Response headers

0: X-Reason
1: UNAVAILABLE
date: Thu, 24 Feb 2022 13:53:45 GMT
content-type: text/html; charset=UTF-8
transfer-encoding: chunked
cache-control: no-cache, private
access-control-allow-origin: *
x-redir: true
content-encoding: gzip
strict-transport-security: max-age=15768000

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			qtteddybear.com/	1969-12-31 23:59:59	Name: uid31 Value: 683052365-20220224085345-271eab46efa22709fe1ce008c04faf56-

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://t9yow.deskcounted.com/?kw=31&s2=683052365 Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

burke-walters.pushpencildesign.eu.com
qtteddybear.com
t9yow.deskcounted.com
www.rentv.com
154.16.249.214
172.245.240.81
178.128.176.49
217.112.43.153
883dce7fbc72e1f569fa9bd836d2052644da5c86157c6f898aa10211c31f7657
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

qtteddybear.com Open in urlscan Pro 154.16.249.214 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

2 Requests

100 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

2 IPs

2 Countries

1 kBTransfer

0 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

qtteddybear.com Open in urlscan Pro
154.16.249.214 Public Scan

Screenshot
Live screenshot

Full Image

2
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

2
IPs

2
Countries

1 kB
Transfer

0 kB
Size

1
Cookies

2 HTTP transactions
0 data transactions