ledgerpapers.com Open in urlscan Pro
2a06:98c1:3121::15 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://bit.ly/3qLIW4O#462415889a5391353a12634462415889a5391353a12634
Effective URL:
https://ledgerpapers.com/index2.php?s1=350356&s2=635739812&s3=2275&p=de1mlt5fc&ow=17
Submission: On November 24 via api (November 24th 2021, 2:42:40 am UTC) from BE — Scanned from DE

Summary HTTP 2 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 3 countries across 4 domains to perform 2 HTTP transactions. The main IP is 2a06:98c1:3121::15, located in United States and belongs to CLOUDFLARENET, US. The main domain is ledgerpapers.com.
TLS certificate: Issued by R3 on November 18th 2021. Valid for: 3 months.

This is the only time ledgerpapers.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	67.199.248.10 67.199.248.10	396982 (GOOGLE-PR...) (GOOGLE-PRIVATE-CLOUD)
1 1	37.221.215.222 37.221.215.222	41075 (ATW-AS) (ATW-AS)
1	94.237.47.139 94.237.47.139	202053 (UPCLOUD) (UPCLOUD)
1	2a06:98c1:312... 2a06:98c1:3121::15	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2

1 67.199.248.10 (United States) 1 redirects

ASN396982 (GOOGLE-PRIVATE-CLOUD, US)
PTR: bit.ly

bit.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.221.215.222 (Hungary) 1 redirects

ASN41075 (ATW-AS, HU)

fadimperfect.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 94.237.47.139 (Finland)

ASN202053 (UPCLOUD, FI)
PTR: squad.flow.com

berneuspulp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a06:98c1:3121::15 (United States)

ASN13335 (CLOUDFLARENET, US)

ledgerpapers.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	ledgerpapers.com ledgerpapers.com	714 B
1	berneuspulp.com berneuspulp.com	484 B
1	fadimperfect.com 1 redirects fadimperfect.com	313 B
1	bit.ly 1 redirects bit.ly	276 B
2	4

	Domain	Requested by
1	ledgerpapers.com	berneuspulp.com
1	berneuspulp.com
1	fadimperfect.com	1 redirects
1	bit.ly	1 redirects
2	4

This site contains no links.

Subject Issuer	Validity	Valid
berneuspulp.com R3	`2021-10-23` - `2022-01-21`	3 months	crt.sh
*.ledgerpapers.com R3	`2021-11-18` - `2022-02-16`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://ledgerpapers.com/index2.php?s1=350356&s2=635739812&s3=2275&p=de1mlt5fc&ow=17
Frame ID: 7F0AC06B8FE4449505CCCE0887515E0F
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

403 Forbidden

Page URL History Show full URLs

https://bit.ly/3qLIW4O HTTP 301
http://fadimperfect.com/2092351Dp5438901VT0ty0ye24azr89684NY HTTP 302
https://berneuspulp.com/0/0/0/12a479398d328b664125037041d3f117/8b-2092351-5438901-89684-0-/03510 Page URL
https://ledgerpapers.com/index2.php?s1=350356&s2=635739812&s3=2275&p=de1mlt5fc&ow=17 Page URL

Page Statistics

2
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

2
IPs

3
Countries

1 kB
Transfer

1 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://bit.ly/3qLIW4O HTTP 301
http://fadimperfect.com/2092351Dp5438901VT0ty0ye24azr89684NY HTTP 302
https://berneuspulp.com/0/0/0/12a479398d328b664125037041d3f117/8b-2092351-5438901-89684-0-/03510 Page URL
https://ledgerpapers.com/index2.php?s1=350356&s2=635739812&s3=2275&p=de1mlt5fc&ow=17 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://bit.ly/3qLIW4O HTTP 301
http://fadimperfect.com/2092351Dp5438901VT0ty0ye24azr89684NY HTTP 302
https://berneuspulp.com/0/0/0/12a479398d328b664125037041d3f117/8b-2092351-5438901-89684-0-/03510

2 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	03510 berneuspulp.com/0/0/0/12a479398d328b664125037041d3f117/8b-2092351-5438901-89684-0-/ Redirect Chain https://bit.ly/3qLIW4O http://fadimperfect.com/2092351Dp5438901VT0ty0ye24azr89684NY https://berneuspulp.com/0/0/0/12a479398d328b664125037041d3f117/8b-2092351-5438901-89684-0-/03510	147 B 484 B	621ms 568ms	Document text/html	94.237.47.139 UPCLOUD
General Check archive.org Show headers Download Go to Full URL https://berneuspulp.com/0/0/0/12a479398d328b664125037041d3f117/8b-2092351-5438901-89684-0-/03510 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 94.237.47.139 , Finland, ASN202053 (UPCLOUD, FI), Reverse DNS squad.flow.com Software Apache / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers date Wed, 24 Nov 2021 02:42:36 GMT content-type text/html; charset=UTF-8 server Apache content-encoding gzip transfer-encoding chunked vary Accept-Encoding Redirect headers Date Wed, 24 Nov 2021 02:42:35 GMT Server Apache/2.4.6 (CentOS) location https://berneuspulp.com/0/0/0/12a479398d328b664125037041d3f117/8b-2092351-5438901-89684-0-/03510 Content-Length 0 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET H2	403	Primary Request index2.php Show response ledgerpapers.com/	552 B 714 B	103ms 69ms	Document text/html	2a06:98c1:3121::15 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ledgerpapers.com/index2.php?s1=350356&s2=635739812&s3=2275&p=de1mlt5fc&ow=17 Requested by Host: berneuspulp.com URL: https://berneuspulp.com/0/0/0/12a479398d328b664125037041d3f117/8b-2092351-5438901-89684-0-/03510 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::15 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `ba06358e68429145a15d0c1cfb211cb1b82680ef0a0b3efa376c68e9c1e4ea03` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://berneuspulp.com/ Response headers date Wed, 24 Nov 2021 02:42:36 GMT content-type text/html cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nQ%2BkwgVXfytQ6zmIQphNniTgZn4%2Boqf9GEAprbH%2Bjzil68rEciMOu4UguIRkSmyjyROcw8xW4vOSLKFT3MJPsx%2B9MtrS4dKPUR3v56y4k6alBM%2FnxtyMNV6SZ%2BUZDot6%2BEyCJvCU0xUItzzhDdlw"}],"group":"cf-nel","max_age":604800} nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 6b2f48f0183bc2f4-FRA content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.bit.ly/	1970-01-20 03:14:33	Name: _bit Value: lao2Gz-c52a75f85448c0f6ab-00v
			berneuspulp.com/	1969-12-31 23:59:59	Name: uid2275 Value: 635739812-20211123214236-b10511f1cea0998f4afefa8914a3b47a-0

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://ledgerpapers.com/index2.php?s1=350356&s2=635739812&s3=2275&p=de1mlt5fc&ow=17 Message: Failed to load resource: the server responded with a status of 403 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

berneuspulp.com
bit.ly
fadimperfect.com
ledgerpapers.com
2a06:98c1:3121::15
37.221.215.222
67.199.248.10
94.237.47.139
ba06358e68429145a15d0c1cfb211cb1b82680ef0a0b3efa376c68e9c1e4ea03

ledgerpapers.com Open in urlscan Pro 2a06:98c1:3121::15 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

2 Requests

100 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

2 IPs

3 Countries

1 kBTransfer

1 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

2 Cookies

1 Console Messages

Indicators

ledgerpapers.com Open in urlscan Pro
2a06:98c1:3121::15 Public Scan

Screenshot
Live screenshot

Full Image

2
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

2
IPs

3
Countries

1 kB
Transfer

1 kB
Size

2
Cookies

2 HTTP transactions
0 data transactions