ip.ru Open in urlscan Pro
212.129.44.131 Public Scan

URL:
http://ip.ru/
Submission: On September 28 via manual (September 28th 2017, 7:08:28 am UTC) from GE

Summary HTTP 14 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 8 IPs in 5 countries across 8 domains to perform 14 HTTP transactions. The main IP is 212.129.44.131, located in France and belongs to AS12876, FR. The main domain is ip.ru.

This is the only time ip.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	212.129.44.131 212.129.44.131	12876 (AS12876) (AS12876)
4	78.140.179.99 78.140.179.99	35415 (WEBZILLA) (WEBZILLA)
1 5	2a02:6b8::1:119 2a02:6b8::1:119	13238 (YANDEX) (YANDEX)
1	88.85.84.123 88.85.84.123	35415 (WEBZILLA) (WEBZILLA)
1	142.4.210.212 142.4.210.212	16276 (OVH) (OVH)
1	74.220.195.201 74.220.195.201	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1 - Unified Layer)
1	88.208.63.21 88.208.63.21	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
14	8

1 212.129.44.131 (France)

ASN12876 (AS12876, FR)
PTR: lmrk.ru

ip.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 78.140.179.99 (Netherlands)

ASN35415 (WEBZILLA, NL)
PTR: v-5-20-29-d7230-99.webazilla.com

ecsexyp.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
umekana.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a02:6b8::1:119 (Russian Federation) 1 redirects

ASN13238 (YANDEX, RU)

mc.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 88.85.84.123 (Netherlands)

ASN35415 (WEBZILLA, NL)
PTR: v-5-20-29-d7084-123.webazilla.com

lvodomi.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.4.210.212 (Montréal, Canada)

ASN16276 (OVH, FR)
PTR: ns531704.ip-142-4-210.net

ads.citylovetoday.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.220.195.201 (Orem, United States)

ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US)
PTR: bluehost-cdn.com

bluehost-cdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 88.208.63.21 (Netherlands)

ASN39572 (ADVANCEDHOSTERS-AS, NL)
PTR: m.thiserver.com

igligan.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	yandex.ru 1 redirects mc.yandex.ru	32 KB
3	ecsexyp.info ecsexyp.info	316 KB
1	igligan.info igligan.info	93 KB
1	bluehost-cdn.com bluehost-cdn.com	32 KB
1	citylovetoday.com ads.citylovetoday.com www.citylovetoday.com Failed	363 B
1	lvodomi.info lvodomi.info	308 B
1	umekana.ru umekana.ru	71 B
1	ip.ru ip.ru	846 B
14	8

	Domain	Requested by
5	mc.yandex.ru	1 redirects ip.ru mc.yandex.ru
3	ecsexyp.info	ip.ru ecsexyp.info
1	igligan.info	ip.ru
1	bluehost-cdn.com	ip.ru
1	ads.citylovetoday.com	ecsexyp.info
1	lvodomi.info	ecsexyp.info
1	umekana.ru	ecsexyp.info
1	ip.ru
0	www.citylovetoday.com Failed	ip.ru
14	9

This site contains links to these domains. Also see Links.

Domain
latest-448653.imbetan.info

Subject Issuer	Validity	Valid
bs.yandex.ru Yandex CA	`2015-12-16` - `2017-12-15`	2 years	crt.sh

This page contains 3 frames:

Primary Page: http://ip.ru/
Frame ID: 22953.1
Requests: 11 HTTP requests in this frame

Frame: http://ads.citylovetoday.com/599d65acf7215a16a1073e43
Frame ID: 22953.2
Requests: 2 HTTP requests in this frame

Frame: http://www.citylovetoday.com/track.php
Frame ID: 22953.3
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Yandex.Metrika (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /mc\.yandex\.ru\/metrika\/watch\.js/i

Page Statistics

14
Requests

29 %
HTTPS

14 %
IPv6

8
Domains

9
Subdomains

8
IPs

5
Countries

472 kB
Transfer

578 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: http://latest-448653.imbetan.info/protJS/MzpxFg4mExYDBAdEXVVKShYDDkZcSkVIRB4NFQETCRYhJkNJUmdjIA0PYEBcU1ZHVlFIRAQLBwwtAkpdXVBRUV9bX1NXXHtXX0AkMzoDAiwbCCoIEgIuAERSChMECEpKBRYJHxcDGjgABQMnBVFYJTQ%2FCEdgCQE5DhdEXVRKShQWCQMDSl1GDhwQFlJISQ0YbBMGTWltcTICMT4FEgZRXEVGGw%3D%3D

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 6

https://mc.yandex.ru/watch/45701232?wmode=5&callback=_ymjsp312036400&page-url=http%3A%2F%2Fip.ru%2F&browser-info=ti%3A6%3As%3A1600x1200x24%3Ask%3A1%3Afpr%3A216613626101%3Acn%3A1%3Aw%3A1600x1200%3Ai%3A20170928070748%3Aet%3A1506582469%3Aen%3Autf-8%3Av%3A897%3Ac%3A1%3Ala%3Aen-us%3Apv%3A1%3Arn%3A888395032%3Ahid%3A609450633%3Ads%3A16%2C15%2C16%2C1%2C0%2C0%2C0%2C4%2C0%2C%2C%2C%2C53%3Ast%3A1506582469%3Au%3A1506582469994752110%3At%3Aip.ru HTTP 302
https://mc.yandex.ru/watch/45701232/1?wmode=5&callback=_ymjsp312036400&page-url=http%3A%2F%2Fip.ru%2F&browser-info=ti%3A6%3As%3A1600x1200x24%3Ask%3A1%3Afpr%3A216613626101%3Acn%3A1%3Aw%3A1600x1200%3Ai%3A20170928070748%3Aet%3A1506582469%3Aen%3Autf-8%3Av%3A897%3Ac%3A1%3Ala%3Aen-us%3Apv%3A1%3Arn%3A888395032%3Ahid%3A609450633%3Ads%3A16%2C15%2C16%2C1%2C0%2C0%2C0%2C4%2C0%2C%2C%2C%2C53%3Ast%3A1506582469%3Au%3A1506582469994752110%3At%3Aip.ru

Request Chain 9

http://www.citylovetoday.com/track.php HTTP 302
http://www.citylovetoday.com/YWReZ/track.php HTTP 302
http://www.citylovetoday.com/track.php

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
ip.ru/ 2 KB
846 B 48ms
16ms Document
text/html 212.129.44.131
AS12876

General

Check archive.org

Show headers Download Go to

Full URL: http://ip.ru/
Protocol: HTTP/1.1
Server: 212.129.44.131 , France, ASN12876 (AS12876, FR),
Reverse DNS: lmrk.ru
Software: nginx / PHP/5.6.31
Resource Hash: e1e66286ddefc602f7309f3ee40e4fbcc2928fa14c0894e91f9195229466fcd7

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: ip.ru
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Cache-Control: no-cache
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36

Response headers

Date: Thu, 28 Sep 2017 07:07:47 GMT
Content-Encoding: gzip
Server: nginx
X-Powered-By: PHP/5.6.31
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Keep-Alive: timeout=60

GET
H/1.1 200
OK 75ujv2p6jgy60i8b4pr4t16k3jttz2lp480yof9p2mhh69bgid4fnyx Show response
ecsexyp.info/ 17 KB
6 KB 64ms
26ms Script
text/javascript 78.140.179.99
WEBZILLA

General

Check archive.org

Show headers Download Go to

Full URL: http://ecsexyp.info/75ujv2p6jgy60i8b4pr4t16k3jttz2lp480yof9p2mhh69bgid4fnyx?6b42bbis=d25MK
Requested by: Host: ip.ru
URL: http://ip.ru/
Protocol: HTTP/1.1
Server: 78.140.179.99 , Netherlands, ASN35415 (WEBZILLA, NL),
Reverse DNS: v-5-20-29-d7230-99.webazilla.com
Software: nginx/1.12.0 /
Resource Hash: 7fee0047379acac73e6752bc5e149cc4a005ae12a19f9728761c8213f45385d6

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: ecsexyp.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36
Accept: */*
Referer: http://ip.ru/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://ip.ru/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36

Response headers

pragma: no-cache
Date: Thu, 28 Sep 2017 07:07:48 GMT
Content-Encoding: gzip
Server: nginx/1.12.0
Vary: Accept-Encoding
Connection: keep-alive
Content-Type: text/javascript
access-control-allow-origin: http://ip.ru
cache-control: no-cache
Transfer-Encoding: chunked
set-cookie
access-control-allow-credentials: true
expires: -1

GET
H/1.1 200
OK watch.js Show response
mc.yandex.ru/metrika/ 86 KB
30 KB 166ms
80ms Script
application/x-javascript 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/metrika/watch.js

Requested by

Host: ip.ru
URL: http://ip.ru/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a02:6b8::1:119 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

nginx/1.8.1 /

Resource Hash

b12ce72ee57e1f894de5f98aee59ca03cc36e0b2a8d675ce4c9f5c8741abc599

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: mc.yandex.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36
Accept: */*
Referer: http://ip.ru/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://ip.ru/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36

Response headers

Date: Thu, 28 Sep 2017 07:07:48 GMT
Content-Encoding: gzip
Last-Modified: Thu, 21 Sep 2017 09:18:34 GMT
Server: nginx/1.8.1
Strict-Transport-Security: max-age=31536000
P3P: CP="NOI DEVa TAIa OUR BUS UNI STA"
Access-Control-Allow-Origin: *
Connection: keep-alive
Content-Type: application/x-javascript
Content-Length: 31070
Expires: Thu, 28 Sep 2017 08:07:48 GMT

GET
H/1.1 200
OK vast.js Show response
ecsexyp.info/handler_static/js/ 290 KB
290 KB 14ms
14ms Script
application/javascript 78.140.179.99
WEBZILLA

General

Check archive.org

Show headers Download Go to

Full URL: http://ecsexyp.info/handler_static/js/vast.js
Requested by: Host: ecsexyp.info
URL: http://ecsexyp.info/75ujv2p6jgy60i8b4pr4t16k3jttz2lp480yof9p2mhh69bgid4fnyx?6b42bbis=d25MK
Protocol: HTTP/1.1
Server: 78.140.179.99 , Netherlands, ASN35415 (WEBZILLA, NL),
Reverse DNS: v-5-20-29-d7230-99.webazilla.com
Software: nginx/1.12.0 /
Resource Hash: a768c06faba9fa77a35d4dff5afd01d645dbd220f8bcceb4dd495b4914f69642

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: ecsexyp.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36
Accept: */*
Referer: http://ip.ru/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://ip.ru/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36

Response headers

Date: Thu, 28 Sep 2017 07:07:48 GMT
Last-Modified: Fri, 07 Jul 2017 13:43:54 GMT
Server: nginx/1.12.0
ETag: "595f901a-4864f"
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 296527

GET
H/1.1 200
OK IzpxFg42GxYBAgc5DRdEUlUb Show response
umekana.ru/retarget/ 50 B
71 B 44ms
28ms Script
text/javascript 78.140.179.99
WEBZILLA

General

Check archive.org

Show headers Download Go to

Full URL: http://umekana.ru/retarget/IzpxFg42GxYBAgc5DRdEUlUb
Requested by: Host: ecsexyp.info
URL: http://ecsexyp.info/75ujv2p6jgy60i8b4pr4t16k3jttz2lp480yof9p2mhh69bgid4fnyx?6b42bbis=d25MK
Protocol: HTTP/1.1
Server: 78.140.179.99 , Netherlands, ASN35415 (WEBZILLA, NL),
Reverse DNS: v-5-20-29-d7230-99.webazilla.com
Software: nginx/1.12.0 /
Resource Hash: 2cc2cdc5f03118c340855b769ad2f77985061b9a1dcca66d3c226abe701b5d4b

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: umekana.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36
Accept: */*
Referer: http://ip.ru/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://ip.ru/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36

Response headers

pragma: no-cache
Date: Thu, 28 Sep 2017 07:07:48 GMT
Content-Encoding: gzip
Server: nginx/1.12.0
Vary: Accept-Encoding
Connection: keep-alive
Content-Type: text/javascript
access-control-allow-origin: http://ip.ru
cache-control: no-cache
Transfer-Encoding: chunked
set-cookie
access-control-allow-credentials: true
expires: -1

GET
H/1.1 200
OK / Show response
lvodomi.info/visitors/ 349 B
308 B 57ms
16ms Script
text/javascript 88.85.84.123
WEBZILLA

General

Check archive.org

Show headers Download Go to

Full URL: http://lvodomi.info/visitors/
Requested by: Host: ecsexyp.info
URL: http://ecsexyp.info/75ujv2p6jgy60i8b4pr4t16k3jttz2lp480yof9p2mhh69bgid4fnyx?6b42bbis=d25MK
Protocol: HTTP/1.1
Server: 88.85.84.123 , Netherlands, ASN35415 (WEBZILLA, NL),
Reverse DNS: v-5-20-29-d7084-123.webazilla.com
Software: nginx/1.12.0 /
Resource Hash: aad2fba5e03e251a64d3b34f8466c65de49b7d8e413d43932badb6c7179f3955

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: lvodomi.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36
Accept: */*
Referer: http://ip.ru/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://ip.ru/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36

Response headers

pragma: no-cache
Date: Thu, 28 Sep 2017 07:07:48 GMT
Content-Encoding: gzip
Server: nginx/1.12.0
Vary: Accept-Encoding
Content-Type: text/javascript
access-control-allow-origin: http://ip.ru
set-cookie: vid=504114076; path=/; expires=Sun, 26 Sep 2027 07:07:48 GMT; httponly
cache-control: no-cache
Transfer-Encoding: chunked
Connection: keep-alive
access-control-allow-credentials: true
expires: -1

GET
H/1.1 200
OK MTpxFwImWF5EX0ZXU1RQSkhECwsCDTgQHxgBRFJFV0ZEYAsAQHFwLg%3D%3D Show response
ecsexyp.info/protJS/ 59 KB
20 KB 382ms
365ms Script
text/javascript 78.140.179.99
WEBZILLA

General

Check archive.org

Show headers Download Go to

Full URL: http://ecsexyp.info/protJS/MTpxFwImWF5EX0ZXU1RQSkhECwsCDTgQHxgBRFJFV0ZEYAsAQHFwLg%3D%3D?JWMhAR8jCAMDExoIAC0CG0Y%3D=&M2MxCAohEScPA1E%3D=&OGMlDRgrDgsULhdE=0&J2MFDRgGGxAHRQ%3D%3D=&L2MhAQ10TkY%3D=&JWM8FA4wG0Y%3D=0&KmMkAQkpExBE=1&P2M1DRknHAseRQ%3D%3D=0&O2M%2BFwInWA%3D%3D=0&LGM%2BAR8jJQ8RRQ%3D%3D=ip.ru&JGMgAQ4mWA%3D%3D=0.4116335883378959
Requested by: Host: ecsexyp.info
URL: http://ecsexyp.info/75ujv2p6jgy60i8b4pr4t16k3jttz2lp480yof9p2mhh69bgid4fnyx?6b42bbis=d25MK
Protocol: HTTP/1.1
Server: 78.140.179.99 , Netherlands, ASN35415 (WEBZILLA, NL),
Reverse DNS: v-5-20-29-d7230-99.webazilla.com
Software: nginx/1.12.0 /
Resource Hash: d6ba5eb3c94a3e53d7f485ce9aaa9c75e786dde5431702a5a35506c7b76ccd2b

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: ecsexyp.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36
Accept: */*
Referer: http://ip.ru/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://ip.ru/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36

Response headers

pragma: no-cache
Date: Thu, 28 Sep 2017 07:07:48 GMT
Content-Encoding: gzip
Server: nginx/1.12.0
Vary: Accept-Encoding
Content-Type: text/javascript
access-control-allow-origin: http://ip.ru
set-cookie: bnr_views={"457773":{"42658":{"v":1,"c":0}}}; path=/; httponly bnr_views={"448653":{"40908":{"v":1,"c":0}},"457773":{"42658":{"v":1,"c":0}}}; path=/; httponly
cache-control: no-cache
Transfer-Encoding: chunked
Connection: keep-alive
access-control-allow-credentials: true
expires: -1

GET
H/1.1

200
OK

1 Show response
mc.yandex.ru/watch/45701232/
Redirect Chain

https://mc.yandex.ru/watch/45701232?wmode=5&callback=_ymjsp312036400&page-url=http%3A%2F%2Fip.ru%2F&browser-info=ti%3A6%3As%3A1600x1200x24%3Ask%3A1%3Afpr%3A216613626101%3Acn%3A1%3Aw%3A1600x1200%3Ai...
https://mc.yandex.ru/watch/45701232/1?wmode=5&callback=_ymjsp312036400&page-url=http%3A%2F%2Fip.ru%2F&browser-info=ti%3A6%3As%3A1600x1200x24%3Ask%3A1%3Afpr%3A216613626101%3Acn%3A1%3Aw%3A1600x1200%3...

132 B
132 B

79ms
39ms

Script
application/javascript

2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/watch/45701232/1?wmode=5&callback=_ymjsp312036400&page-url=http%3A%2F%2Fip.ru%2F&browser-info=ti%3A6%3As%3A1600x1200x24%3Ask%3A1%3Afpr%3A216613626101%3Acn%3A1%3Aw%3A1600x1200%3Ai%3A20170928070748%3Aet%3A1506582469%3Aen%3Autf-8%3Av%3A897%3Ac%3A1%3Ala%3Aen-us%3Apv%3A1%3Arn%3A888395032%3Ahid%3A609450633%3Ads%3A16%2C15%2C16%2C1%2C0%2C0%2C0%2C4%2C0%2C%2C%2C%2C53%3Ast%3A1506582469%3Au%3A1506582469994752110%3At%3Aip.ru

Requested by

Host: ip.ru
URL: http://ip.ru/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a02:6b8::1:119 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

nginx/1.8.1 /

Resource Hash

b7e27dcebde0f1c212b1ca513bc673a6a08649bf6700d08148ec9898c6048c2f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: mc.yandex.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36
Accept: */*
Referer: http://ip.ru/
Cookie: i=77bRsbHW0H/aB/6Wn80C9JGxwVtH7tKsXW1kf/oRsmMPtd5ZZ5bphIdKF499HfWOyyXGFg/lYdBQekobzys5B+feHA8=; yandexuid=4503435571506582468; yp=1821942468.yrts.1506582468; yabs-sid=2045309741506582468
Connection: keep-alive
Cache-Control: no-cache
Referer: http://ip.ru/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 28 Sep 2017 07:07:48 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 28 Sep 2017 07:07:48 GMT
Server: nginx/1.8.1
P3P: CP="NOI DEVa TAIa OUR BUS UNI STA"
Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: application/javascript
Content-Length: 132
X-XSS-Protection: 1; mode=block
Expires: Thu, 28 Sep 2017 07:07:48 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 28 Sep 2017 07:07:48 GMT
Last-Modified: Thu, 28 Sep 2017 07:07:48 GMT
Server: nginx/1.8.1
Connection: keep-alive
P3P: CP="NOI DEVa TAIa OUR BUS UNI STA"
Location: https://mc.yandex.ru/watch/45701232/1?wmode=5&callback=_ymjsp312036400&page-url=http%3A%2F%2Fip.ru%2F&browser-info=ti%3A6%3As%3A1600x1200x24%3Ask%3A1%3Afpr%3A216613626101%3Acn%3A1%3Aw%3A1600x1200%3Ai%3A20170928070748%3Aet%3A1506582469%3Aen%3Autf-8%3Av%3A897%3Ac%3A1%3Ala%3Aen-us%3Apv%3A1%3Arn%3A888395032%3Ahid%3A609450633%3Ads%3A16%2C15%2C16%2C1%2C0%2C0%2C0%2C4%2C0%2C%2C%2C%2C53%3Ast%3A1506582469%3Au%3A1506582469994752110%3At%3Aip.ru
Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0
Set-Cookie: i=77bRsbHW0H/aB/6Wn80C9JGxwVtH7tKsXW1kf/oRsmMPtd5ZZ5bphIdKF499HfWOyyXGFg/lYdBQekobzys5B+feHA8=; Expires=Sun, 26-Sep-2027 07:07:48 GMT; Domain=.yandex.ru; Path=/; HttpOnly yandexuid=4503435571506582468; domain=.yandex.ru; path=/; expires=Sun, 26-Sep-2027 07:07:48 GMT yp=1821942468.yrts.1506582468; domain=.yandex.ru; path=/; expires=Sun, 26-Sep-2027 07:07:48 GMT yabs-sid=2045309741506582468; path=/
Content-Length: 0
X-XSS-Protection: 1; mode=block
Expires: Thu, 28 Sep 2017 07:07:48 GMT

GET
H/1.1 200
OK advert.gif
mc.yandex.ru/metrika/ 43 B
43 B 80ms
40ms Image
image/gif 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.ru/metrika/advert.gif

Requested by

Host: ip.ru
URL: http://ip.ru/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a02:6b8::1:119 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

nginx/1.8.1 /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: mc.yandex.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://ip.ru/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://ip.ru/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36

Response headers

Date: Thu, 28 Sep 2017 07:07:48 GMT
Last-Modified: Mon, 12 Oct 2015 13:09:09 GMT
Server: nginx/1.8.1
P3P: CP="NOI DEVa TAIa OUR BUS UNI STA"
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 1; mode=block
Expires: Thu, 22 Aug 2047 07:07:48 GMT

GET
H/1.1 200
OK Cookie set 599d65acf7215a16a1073e43 Show response
ads.citylovetoday.com/ Frame 2295 363 B
363 B 286ms
159ms Script
text/javascript 142.4.210.212
OVH

General

Check archive.org

Show headers Download Go to

Full URL: http://ads.citylovetoday.com/599d65acf7215a16a1073e43
Requested by: Host: ecsexyp.info
URL: http://ecsexyp.info/protJS/MTpxFwImWF5EX0ZXU1RQSkhECwsCDTgQHxgBRFJFV0ZEYAsAQHFwLg%3D%3D?JWMhAR8jCAMDExoIAC0CG0Y%3D=&M2MxCAohEScPA1E%3D=&OGMlDRgrDgsULhdE=0&J2MFDRgGGxAHRQ%3D%3D=&L2MhAQ10TkY%3D=&JWM8FA4wG0Y%3D=0&KmMkAQkpExBE=1&P2M1DRknHAseRQ%3D%3D=0&O2M%2BFwInWA%3D%3D=0&LGM%2BAR8jJQ8RRQ%3D%3D=ip.ru&JGMgAQ4mWA%3D%3D=0.4116335883378959
Protocol: HTTP/1.1
Server: 142.4.210.212 Montréal, Canada, ASN16276 (OVH, FR),
Reverse DNS: ns531704.ip-142-4-210.net
Software: nginx/1.0.16 /
Resource Hash: f05e3998545267c331068a435b5966dd4fc56a4b5464065ac96c3ec311c23b2a

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: ads.citylovetoday.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36
Accept: */*
Referer: http://ip.ru/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://ip.ru/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 28 Sep 2017 07:07:11 GMT
Cache-Control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
Server: nginx/1.0.16
Set-Cookie: 10121696566739816260=2499489278|8|4|8|29|0|1|0|b591a46a6c0168eee52cc4f2666d43ed; Path=/; Expires=Fri, 29 Sep 2017 07:07:11 GMT
Content-Length: 363
Content-Type: text/javascript;charset=utf-8

GET

track.php
www.citylovetoday.com/ Frame 2295
Redirect Chain

http://www.citylovetoday.com/track.php
http://www.citylovetoday.com/YWReZ/track.php
http://www.citylovetoday.com/track.php

0
0

GET
H/1.1 200
OK 728x90BW.png
bluehost-cdn.com/media/partner/images/doubledownload/728x90/ Frame 2295 32 KB
32 KB 389ms
189ms Image
image/png 74.220.195.201
Unified Layer

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://bluehost-cdn.com/media/partner/images/doubledownload/728x90/728x90BW.png
Requested by: Host: ip.ru
URL: http://ip.ru/
Protocol: HTTP/1.1
Server: 74.220.195.201 Orem, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS: bluehost-cdn.com
Software: Apache /
Resource Hash: b8fb78fddf63fba528b8a7075298f0ab1601953f30fc2b02d2c0f3806b45ca63

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: bluehost-cdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://ip.ru/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://ip.ru/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36

Response headers

Date: Thu, 28 Sep 2017 07:07:49 GMT
Content-Encoding: gzip
Server: Apache
Age: 1778
Vary: Accept-Encoding
X-Cache: cached
Content-Type: image/png
X-O: 02b4fc48d0f44fd6271fd803c00edde8
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 32402

GET
H/1.1 200
OK 7fe8a54a13237034a322c393ef926068.jpeg
igligan.info/ 93 KB
93 KB 49ms
12ms Image
image/jpeg 88.208.63.21
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://igligan.info/7fe8a54a13237034a322c393ef926068.jpeg
Requested by: Host: ip.ru
URL: http://ip.ru/
Protocol: HTTP/1.1
Server: 88.208.63.21 , Netherlands, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS: m.thiserver.com
Software: nginx/1.12.1 /
Resource Hash: 7f58e9ab3e842f4d83947b24defee0cda38b0595abe5fd0d9d27f9a9243b2220

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: igligan.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://ip.ru/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://ip.ru/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36

Response headers

Date: Thu, 28 Sep 2017 07:07:49 GMT
Last-Modified: Fri, 04 Aug 2017 12:04:57 GMT
Server: nginx/1.12.1
ETag: "598462e9-172c5"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 94917

POST
H/1.1 200
OK 45701232
mc.yandex.ru/watch/ 43 B
43 B 39ms
39ms Other
image/gif 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/watch/45701232?page-url=http%3A%2F%2Fip.ru%2F&force-urlencoded=1&browser-info=ti%3A1%3As%3A1600x1200x24%3Ask%3A1%3Aadb%3A2%3Afpr%3A216613626101%3Acn%3A1%3Aw%3A1600x1200%3Ai%3A20170928070803%3Aet%3A1506582484%3Aen%3Autf-8%3Av%3A897%3Ac%3A1%3Ala%3Aen-us%3Aar%3A1%3Anb%3A1%3Acl%3A127%3Arn%3A1036059357%3Ahid%3A609450633%3Ads%3A%2C%2C%2C%2C%2C%2C%2C%2C%2C%2C%2C%2C%3Ast%3A1506582484%3Au%3A1506582469994752110

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/watch.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a02:6b8::1:119 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

nginx/1.8.1 /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Origin: http://ip.ru
Accept-Encoding: gzip, deflate
Host: mc.yandex.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Accept: */*
Cache-Control: max-age=0
Referer: http://ip.ru/
Cookie: i=77bRsbHW0H/aB/6Wn80C9JGxwVtH7tKsXW1kf/oRsmMPtd5ZZ5bphIdKF499HfWOyyXGFg/lYdBQekobzys5B+feHA8=; yandexuid=4503435571506582468; yp=1821942468.yrts.1506582468; yabs-sid=2045309741506582468
Connection: keep-alive
Content-Length: 0
Cache-Control: max-age=0
Origin: http://ip.ru
Referer: http://ip.ru/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Pragma: no-cache
Date: Thu, 28 Sep 2017 07:08:03 GMT
Last-Modified: Thu, 28 Sep 2017 07:08:03 GMT
Server: nginx/1.8.1
P3P: CP="NOI DEVa TAIa OUR BUS UNI STA"
Access-Control-Allow-Origin: http://ip.ru
Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 1; mode=block
Expires: Thu, 28 Sep 2017 07:08:03 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.citylovetoday.com
URL: http://www.citylovetoday.com/track.php

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ads.citylovetoday.com
bluehost-cdn.com
ecsexyp.info
igligan.info
ip.ru
lvodomi.info
mc.yandex.ru
umekana.ru
www.citylovetoday.com
www.citylovetoday.com
142.4.210.212
212.129.44.131
2a02:6b8::1:119
74.220.195.201
78.140.179.99
88.208.63.21
88.85.84.123
2cc2cdc5f03118c340855b769ad2f77985061b9a1dcca66d3c226abe701b5d4b
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
7f58e9ab3e842f4d83947b24defee0cda38b0595abe5fd0d9d27f9a9243b2220
7fee0047379acac73e6752bc5e149cc4a005ae12a19f9728761c8213f45385d6
a768c06faba9fa77a35d4dff5afd01d645dbd220f8bcceb4dd495b4914f69642
aad2fba5e03e251a64d3b34f8466c65de49b7d8e413d43932badb6c7179f3955
b12ce72ee57e1f894de5f98aee59ca03cc36e0b2a8d675ce4c9f5c8741abc599
b7e27dcebde0f1c212b1ca513bc673a6a08649bf6700d08148ec9898c6048c2f
b8fb78fddf63fba528b8a7075298f0ab1601953f30fc2b02d2c0f3806b45ca63
d6ba5eb3c94a3e53d7f485ce9aaa9c75e786dde5431702a5a35506c7b76ccd2b
e1e66286ddefc602f7309f3ee40e4fbcc2928fa14c0894e91f9195229466fcd7
f05e3998545267c331068a435b5966dd4fc56a4b5464065ac96c3ec311c23b2a

ip.ru Open in urlscan Pro 212.129.44.131 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

14 Requests

29 %HTTPS

14 %IPv6

8 Domains

9 Subdomains

8 IPs

5 Countries

472 kBTransfer

578 kBSize

0 Cookies

1 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

0 Cookies

Indicators

ip.ru Open in urlscan Pro
212.129.44.131 Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

29 %
HTTPS

14 %
IPv6

8
Domains

9
Subdomains

8
IPs

5
Countries

472 kB
Transfer

578 kB
Size

0
Cookies

14 HTTP transactions
0 data transactions