rd.lesac.ru - urlscan.io

Summary

This website contacted 3 IPs in 3 countries across 7 domains to perform 3 HTTP transactions. The main IP is 89.117.55.57, located in Düsseldorf, Germany and belongs to CONTABO, DE. The main domain is rd.lesac.ru.

This is the only time rd.lesac.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:10:... 2606:4700:10::6814:8a41	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	185.151.204.11 185.151.204.11	61273 (ADJUST-NL) (ADJUST-NL)
2 2	161.97.111.73 161.97.111.73	51167 (CONTABO) (CONTABO)
1	89.117.55.57 89.117.55.57	51167 (CONTABO) (CONTABO)
1	2a00:1450:400... 2a00:1450:4001:82a::200a	15169 (GOOGLE) (GOOGLE)
1	104.23.140.12 104.23.140.12	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	3

1 2606:4700:10::6814:8a41 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

tinyurl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.151.204.11 (United States) 1 redirects

ASN61273 (ADJUST-NL, DE)

app.adjust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 161.97.111.73 (Nuremberg, Germany) 2 redirects

ASN51167 (CONTABO, DE)
PTR: vmi542165.contaboserver.net

hotmovies25.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
hdvipmovies.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 89.117.55.57 (Düsseldorf, Germany)

ASN51167 (CONTABO, DE)
PTR: vmi1178504.contaboserver.net

rd.lesac.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.23.140.12 (None, )

ASN13335 (CLOUDFLARENET, US)

img001.prntscr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	prntscr.com img001.prntscr.com — Cisco Umbrella Rank: 324839	27 KB
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 364	30 KB
1	lesac.ru rd.lesac.ru	15 KB
1	hdvipmovies.com 1 redirects hdvipmovies.com	332 B
1	hotmovies25.com 1 redirects hotmovies25.com	343 B
1	adjust.com 1 redirects app.adjust.com — Cisco Umbrella Rank: 1662	1 KB
1	tinyurl.com 1 redirects tinyurl.com — Cisco Umbrella Rank: 16391	585 B
3	7

	Domain	Requested by
1	img001.prntscr.com	rd.lesac.ru
1	ajax.googleapis.com	rd.lesac.ru
1	rd.lesac.ru
1	hdvipmovies.com	1 redirects
1	hotmovies25.com	1 redirects
1	app.adjust.com	1 redirects
1	tinyurl.com	1 redirects
3	7

This site contains no links.

Subject Issuer	Validity	Valid
upload.video.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-02` - `2024-05-01`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://rd.lesac.ru/books.php
Frame ID: A48F589E7337A9E88E5551F05404ACC0
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Link Locked

Page URL History Show full URLs

https://tinyurl.com/y49ww2fz HTTP 301
https://app.adjust.com/97grly?label=2ch_002&redirect=http://hotmovies25.com/765/ebookt901/2 HTTP 302
http://hotmovies25.com/765/ebookt901/2 HTTP 302
http://hdvipmovies.com/153/back/14 HTTP 302
http://rd.lesac.ru/books.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

3
Requests

67 %
HTTPS

33 %
IPv6

7
Domains

7
Subdomains

3
IPs

3
Countries

72 kB
Transfer

185 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://tinyurl.com/y49ww2fz HTTP 301
https://app.adjust.com/97grly?label=2ch_002&redirect=http://hotmovies25.com/765/ebookt901/2 HTTP 302
http://hotmovies25.com/765/ebookt901/2 HTTP 302
http://hdvipmovies.com/153/back/14 HTTP 302
http://rd.lesac.ru/books.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request books.php Show response
rd.lesac.ru/
Redirect Chain

https://tinyurl.com/y49ww2fz
https://app.adjust.com/97grly?label=2ch_002&redirect=http://hotmovies25.com/765/ebookt901/2
http://hotmovies25.com/765/ebookt901/2
http://hdvipmovies.com/153/back/14
http://rd.lesac.ru/books.php

75 KB
15 KB

47ms
11ms

Document
text/html

89.117.55.57
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL: http://rd.lesac.ru/books.php
Protocol: HTTP/1.1
Server: 89.117.55.57 Düsseldorf, Germany, ASN51167 (CONTABO, DE),
Reverse DNS: vmi1178504.contaboserver.net
Software: nginx /
Resource Hash: f0cf370e2f6f9426f36e99539048d9bdb72d4b89b4218553a7151118aa8a9d30

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Thu, 23 Nov 2023 08:34:25 GMT
Server: nginx
Transfer-Encoding: chunked

Redirect headers

Connection: keep-alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Thu, 23 Nov 2023 08:34:25 GMT
Keep-Alive: timeout=60
Location: http://rd.lesac.ru/books.php
Server: nginx
X-Powered-By: PHP/7.4.29

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ 84 KB
30 KB 28ms
6ms Script
text/javascript 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js

Requested by

Host: rd.lesac.ru
URL: http://rd.lesac.ru/books.php

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 06:18:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8171
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30028
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Nov 2024 06:18:14 GMT

GET
H2 200 n4k_JsPJQzyVler597bBlg.png
img001.prntscr.com/file/img001/ 27 KB
27 KB 48ms
21ms Image
image/png 104.23.140.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img001.prntscr.com/file/img001/n4k_JsPJQzyVler597bBlg.png
Requested by: Host: rd.lesac.ru
URL: http://rd.lesac.ru/books.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.140.12 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cbe86b6047f4e923b61d05d06e3321fa2caabc5a5c0febbfa6dc0dc7d4161057

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://rd.lesac.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 08:34:25 GMT
cf-cache-status: HIT
x-bz-file-id: 4_z51bcbe33c7b20fe37efb0b11_f100181a95030f64f_d20230824_m204318_c004_v0402017_t0001_u01692909798598
age: 182860
cf-polished: status=not_needed
x-bz-content-sha1: 4c05f766274e71740dffb9efec7a4f1aed9faa87
x-bz-file-name: n4k_JsPJQzyVler597bBlg.png
alt-svc: h3=":443"; ma=86400
content-length: 27524
x-bz-upload-timestamp: 1692909798598
cf-bgj: imgq:100,h2pri
last-modified: Thu, 09 Nov 2023 12:53:26 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 82a812af6bab37e6-FRA

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			hotmovies25.com/	1970-01-20 16:26:54	Name: cu_ebookt901 Value: 0
			hdvipmovies.com/	1970-01-20 16:26:54	Name: cu_back Value: 0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
app.adjust.com
hdvipmovies.com
hotmovies25.com
img001.prntscr.com
rd.lesac.ru
tinyurl.com
104.23.140.12
161.97.111.73
185.151.204.11
2606:4700:10::6814:8a41
2a00:1450:4001:82a::200a
89.117.55.57
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
cbe86b6047f4e923b61d05d06e3321fa2caabc5a5c0febbfa6dc0dc7d4161057
f0cf370e2f6f9426f36e99539048d9bdb72d4b89b4218553a7151118aa8a9d30

rd.lesac.ru Open in urlscan Pro 89.117.55.57 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

3 Requests

67 %HTTPS

33 %IPv6

7 Domains

7 Subdomains

3 IPs

3 Countries

72 kBTransfer

185 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

2 Cookies

Indicators

rd.lesac.ru Open in urlscan Pro
89.117.55.57 Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

67 %
HTTPS

33 %
IPv6

7
Domains

7
Subdomains

3
IPs

3
Countries

72 kB
Transfer

185 kB
Size

2
Cookies

3 HTTP transactions
0 data transactions