517s61.reminews.com Open in urlscan Pro
213.174.135.1  Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://thanosofcos5.com/afu.php?zoneid=1583340&var=1854491 Page URL
2. https://517s61.reminews.com/dannig/tube-player/index.html?var=1583340&ymid=2107161032687ecdc28a654522a7ae004a22&rc=1&mrc=0&fsc=0&zoneid=1601571&tburl=https://play-vids.com/?geo=cz&proxy=true Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	afu.php Show response thanosofcos5.com/	917 B 1 KB	144ms 53ms	Document text/html	109.206.162.83 SERVEREL-AS
General Check archive.org Show headers Download Go to Full URL https://thanosofcos5.com/afu.php?zoneid=1583340&var=1854491 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 109.206.162.83 , Netherlands, ASN50245 (SERVEREL-AS, NL), Reverse DNS 83.162.serverel.net Software nginx / Resource Hash 84d612425f6a6d85aaef2656838588a75eb2350e658d89d932461215a9742dc9 Request headers :method GET :authority thanosofcos5.com :scheme https :path /afu.php?zoneid=1583340&var=1854491 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36 Response headers server nginx date Fri, 16 Jul 2021 15:32:33 GMT content-type text/html; charset=utf-8 vary Accept-Encoding set-cookie UID=21071610323dad01b21c7a4d1b9349a71f91; Path=/; SameSite=None; Expires=Sat, 16 Jul 2022 15:32:33 GMT; HttpOnly; Secure OXCCLK=ABPemAAAAAAAAAAB; Path=/; SameSite=None; Expires=Sat, 17 Jul 2021 15:32:33 GMT; Secure OXPCLK=AAHg4AAAAAAAAAAB; Path=/; SameSite=None; Expires=Sat, 17 Jul 2021 15:32:33 GMT; Secure ppucnt=1; Path=/; SameSite=None; Expires=Sat, 17 Jul 2021 15:32:33 GMT; Secure content-encoding gzip timing-allow-origin *
GET H2	200	Primary Request index.html Show response 517s61.reminews.com/dannig/tube-player/	15 KB 16 KB	275ms 39ms	Document text/html	213.174.135.1 ADVANCEDHOSTERS-AS
General Check archive.org Show headers Download Go to Full URL https://517s61.reminews.com/dannig/tube-player/index.html?var=1583340&ymid=2107161032687ecdc28a654522a7ae004a22&rc=1&mrc=0&fsc=0&zoneid=1601571&tburl=https://play-vids.com/?geo=cz&proxy=true Requested by Host: thanosofcos5.com URL: https://thanosofcos5.com/afu.php?zoneid=1583340&var=1854491 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 213.174.135.1 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL), Reverse DNS Software nginx/1.16.1 / Resource Hash 50849c5b3115a53ee8aaa77e56c77cd86855b416633bc0bafb2add9d89eeb220 Request headers :method GET :authority 517s61.reminews.com :scheme https :path /dannig/tube-player/index.html?var=1583340&ymid=2107161032687ecdc28a654522a7ae004a22&rc=1&mrc=0&fsc=0&zoneid=1601571&tburl=https://play-vids.com/?geo=cz&proxy=true pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36 Response headers date Fri, 16 Jul 2021 15:32:33 GMT content-type text/html; charset=utf-8 content-length 15569 server nginx/1.16.1 last-modified Mon, 05 Jul 2021 17:21:19 GMT etag 37b05649c5762376fba511386e04c36d x-timestamp 1625505678.66205 x-trans-id txdaf8a3ba65b24edea83fd-0060ec1e3a x-openstack-request-id txdaf8a3ba65b24edea83fd-0060ec1e3a cache-control max-age=172800 access-control-allow-origin * access-control-allow-methods HEAD,GET,POST,PUT,PATCH,DELETE,OPTIONS access-control-allow-headers Content-Type,X-Requested-With,X-Auth-Token,X-Openstack-Request-Id,X-Container-Meta-type,X-Container-Meta-Temp-URL-Key,Authorization access-control-expose-headers X-Container-Meta-Temp-Url-Key,X-Container-Bytes-Used,Last-Modified,X-Timestamp expires Sun, 18 Jul 2021 15:32:33 GMT vary Accept-Encoding x-proxy-cache HIT accept-ranges bytes
GET H2	200	script.js Show response 2818.selornews.com/dannig/tube-player/js/	3 KB 3 KB	162ms 35ms	Script text/javascript	213.174.135.2 ADVANCEDHOSTERS-AS
General Check archive.org Show headers Download Go to Full URL https://2818.selornews.com/dannig/tube-player/js/script.js?a=3 Requested by Host: 517s61.reminews.com URL: https://517s61.reminews.com/dannig/tube-player/index.html?var=1583340&ymid=2107161032687ecdc28a654522a7ae004a22&rc=1&mrc=0&fsc=0&zoneid=1601571&tburl=https://play-vids.com/?geo=cz&proxy=true Protocol H2 Security TLS 1.3, , AES_256_GCM Server 213.174.135.2 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL), Reverse DNS Software nginx/1.16.1 / Resource Hash e1956c56a90a9b13e4960c7ca32a8e1cadc0d1e23ae2a1065e58869f4a8cba98 Request headers Referer https://517s61.reminews.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36 Response headers date Fri, 16 Jul 2021 15:32:33 GMT x-openstack-request-id tx79c123708fb549c5bf358-0060ec2499 x-trans-id tx79c123708fb549c5bf358-0060ec2499 x-timestamp 1626088459.32634 accept-ranges bytes expires Sun, 18 Jul 2021 15:32:33 GMT last-modified Mon, 12 Jul 2021 11:14:20 GMT server nginx/1.16.1 etag 0b71a6b9fcb94036e00186176a89655e vary Accept-Encoding access-control-allow-methods HEAD,GET,POST,PUT,PATCH,DELETE,OPTIONS content-type text/javascript access-control-allow-origin * access-control-expose-headers X-Container-Meta-Temp-Url-Key,X-Container-Bytes-Used,Last-Modified,X-Timestamp cache-control max-age=172800 content-length 2633 access-control-allow-headers Content-Type,X-Requested-With,X-Auth-Token,X-Openstack-Request-Id,X-Container-Meta-type,X-Container-Meta-Temp-URL-Key,Authorization x-proxy-cache HIT
GET H2	200	skip-button.webp 321.selornews.com/dannig/tube-player/img/	5 KB 5 KB	162ms 37ms	Image image/webp	213.174.135.2 ADVANCEDHOSTERS-AS
General Check archive.org Show headers Download Go to Show image Full URL https://321.selornews.com/dannig/tube-player/img/skip-button.webp Requested by Host: 517s61.reminews.com URL: https://517s61.reminews.com/dannig/tube-player/index.html?var=1583340&ymid=2107161032687ecdc28a654522a7ae004a22&rc=1&mrc=0&fsc=0&zoneid=1601571&tburl=https://play-vids.com/?geo=cz&proxy=true Protocol H2 Security TLS 1.3, , AES_256_GCM Server 213.174.135.2 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL), Reverse DNS Software nginx/1.16.1 / Resource Hash 4d1449898da756c5bff9e9696a2c71ea1ab9e6e96c5dfec29885a63ac237eb3b Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36 Response headers date Fri, 16 Jul 2021 15:32:33 GMT x-openstack-request-id tx80cb53ad8f504402a54b7-0060ec02b2 x-trans-id tx80cb53ad8f504402a54b7-0060ec02b2 x-timestamp 1608540262.03735 accept-ranges bytes expires Sun, 18 Jul 2021 15:32:33 GMT last-modified Mon, 21 Dec 2020 08:44:23 GMT server nginx/1.16.1 etag da2dc41d023f4fcc89675351f9117c3d vary Accept-Encoding access-control-allow-methods HEAD,GET,POST,PUT,PATCH,DELETE,OPTIONS content-type image/webp access-control-allow-origin * access-control-expose-headers X-Container-Meta-Temp-Url-Key,X-Container-Bytes-Used,Last-Modified,X-Timestamp cache-control max-age=172800 content-length 5006 access-control-allow-headers Content-Type,X-Requested-With,X-Auth-Token,X-Openstack-Request-Id,X-Container-Meta-type,X-Container-Meta-Temp-URL-Key,Authorization x-proxy-cache HIT

32 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| requestPermission string| url_string object| url string| source string| clickid number| reloadCount string| BASE_SW_SCRIPT_SRC number| maxReloadCount number| zoneid string| trafficbackUrlRaw string| trafficbackUrl string| src object| full_domain string| domain function| getReloadCount function| getRandomSubdomain function| changeSubdomain string| target_url function| back function| forward undefined| trafficbackUrlFinal

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://2818.selornews.com/dannig/tube-player/js/script.js?a=3(Line 18) Message: reminews.com

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

2818.selornews.com
321.selornews.com
517s61.reminews.com
thanosofcos5.com
109.206.162.83
213.174.135.1
213.174.135.2
4d1449898da756c5bff9e9696a2c71ea1ab9e6e96c5dfec29885a63ac237eb3b
50849c5b3115a53ee8aaa77e56c77cd86855b416633bc0bafb2add9d89eeb220
84d612425f6a6d85aaef2656838588a75eb2350e658d89d932461215a9742dc9
e1956c56a90a9b13e4960c7ca32a8e1cadc0d1e23ae2a1065e58869f4a8cba98